Splunk Search

Please help me understand Eval function query

aaa2324
Explorer
  • Please help to understand the logic of below query 
  • eval count=if(isnull(count), -1,count)
Labels (1)
0 Karma

JacekF
Path Finder

If count value is null set count value to -1, use the count value otherwise (i.e. if count value is not null do not change it).

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

This is the same as 

| fillnull value=-1 count

or 

| eval count=coalesce(count,-1)

 

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.0.2 Availability: On cloud and On-premise!

A few months ago, we released Splunk Enterprise Security 8.0 for our cloud customers. Today, we are excited to ...

Logs to Metrics

Logs and Metrics Logs are generally unstructured text or structured events emitted by applications and written ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...