how to sum two fields with empty values in some values of one field

[Ahmedkhalil]

Hello,

i have two fields and want to sum values of them in new field as below

new field = field1 + field2
i have added below expression in props.conf

EVAL-sum_Acct_input= (field1*4)+(field2/1073741824)
problem is that i found event coverage of new field sum_acct_input = event coverage of field1 as field one not exist in all events ( it has empty values ) so how can i overcome this issue ? and also how to make this expression at index time not search time

[somesoni2 · Accepted solution]

You can utilize "coalesce" function to handle empty/null values of field 1 like below

props.conf

EVAL-sum_Acct_input = (coalesce(field1,0)*4+(field2/1073741824)

Per my knowledge, calculated fields can't be created during index time.

[martin_mueller]

coalesce(field1, field2) is a nicer way of writing if(isnotnull(field1), field1, field2) - basically, "take the first field from the list of arguments that isn't null".

[Ahmedkhalil]

thanks alot for your help i tested it and worked fine but may i know what excatly coalesce do ?