What is null values? in a simple way

[mkhedr]

can anyone explain what is null values returned from the search? As simple as possible

[woodcock]

It is the total lack of any value, which is different from a blank (0-length) empty value. These are non-null values:

| makeresults | eval non-null_empty="", non-null_space = " ", non-null_letter = "1" | foreach non* [ eval <<FIELD>>_len = len('<<FIELD>>') ] | table *null*

This are nulls (they do not exist at all):

| makeresults | eval now_null=null() | eval now_null_len=len(now_null), always_null_len=len(always_null) | table now_null now_null_len always_null always_null_len

[niketn]

@mkhedr community would be able to assist you further if you provide more context to what are you trying to see and where you see NULL value.

NULL value represents and event row where specific field being queried is not present. There are several scenarios this may happen:

Scenario 1
If it is with reference to timechart and you have timechart split by a specific field lets say field1 and you see the NULL series that would be because you have filtered events where field1 does not exist.

Usually, adding field1="*" to your main search query while pulling data from index solves this.
Scenario 2
If you have some calculations/evaluations which do not apply to all the rows selected then it will generate fields with NULL values. For example, if field1 below has three or more values, then myfield will have NULL values foe each event where field1 is not alpha or beta

| eval myfield=case(field1=="alpha","A",
                                    field1=="beta","B")

Adding a default case using 1==1 or true() condition usually fixes this by providing the default value. For example:

| eval myfield=case(field1=="alpha","A",
                                    field1=="beta","B",
                                    true(),"unknown")

These are just couple of scenarios, but there may be several other situations where you can have NULL value in your data like referring to field at particular pipe in SPL where it may not exist. So requesting you to provide more context to your question for us to assist with your exact question.