Splunk Search

What does the coalesce command mean in this Splunk search?

pavanae
Builder

What does the below coalesce command mean in this Splunk search? Any explanation would be appreciated

eval fieldA=coalesce(fieldA,"")
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The coalesce command is essentially a simplified case or if-then-else statement. It returns the first of its arguments that is not null. In your example, fieldA is set to the empty string if it is null. See http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/CommonEvalFunctions.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

gcusello
Legend

Hi pavanae,
are you sure that this function runs?
every way, coalesce "takes an arbitrary number of arguments and returns the first value that is not null", so there is no sense to put a null value in this function (see http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/CommonEvalFunctions).
If you want to give to FieldA a different value when it's null, you have to use eval FieldA=if(isnull(FieldA),"X",FieldA).
Bye.
Giuseppe

0 Karma

richgalloway
SplunkTrust
SplunkTrust

An empty string ("") is not the same as a null value.

---
If this reply helps you, an upvote would be appreciated.

richgalloway
SplunkTrust
SplunkTrust

The coalesce command is essentially a simplified case or if-then-else statement. It returns the first of its arguments that is not null. In your example, fieldA is set to the empty string if it is null. See http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/CommonEvalFunctions.

---
If this reply helps you, an upvote would be appreciated.
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...