If the field value is null, the value is null, and if it is not controlled, it is still the original value
I want to get a field value ,if it is null ,I set it null,if not ,I hope it still the original value
I use :
index = abc_text | eval Codelocation = if(isnull(Codelocation), "null",Codelocation)|stats max(_time) as _time values(Codelocation) as codelocation by source
It did not achieve the desired effect.
use null() instead of "null"
@WXY, just a clarification - if the value is null why do you want to set it again to null ? Do you mean you want to convert "space" to null.
Anyway try this |eval Codelocation = if(isnull(Codelocation), null(),Codelocation)
|eval Codelocation = if(isnull(Codelocation), null(),Codelocation)