Splunk Search

## what does the coalesce and eval in my query do?

Builder

Could anyone explain what does the below search string means ?

| eval fieldA=coalesce(abc, "def")

Tags (3)
1 Solution
Legend

The verb `eval` is similar to the way that the word `set` is used in java or c. It flags to splunk that it is supposed to calculate whatever is to the right of the equals sign and assign that value to the variable on the left side of the equals sign.

The verb `coalesce` indicates that the first non-null value is to be used. In this case, it is equivalent to either of the following lines...

``````| eval fieldA=if(isnotnull(abc),abc,"def")
| eval fieldA=if(isnull(abc),"def",abc)
``````

when there are only two values, `coalesce` is not much better than the `if-isnull`, but at three values, the usefulness of `coalesce` becomes obvious, and at four, using anything else is ridiculous.

The following are equivalent for three items...

``````| eval fieldA=coalesce(fieldA,fieldB,fieldC)
| eval fieldA=if(isnotnull(fieldA),fieldA,if(isnotnull(fieldB),fieldB,fieldC))
| eval fieldA=if(isnull(fieldA),if(isnull(fieldB),fieldC,fieldB),fieldA)
``````

The following are equivalent for four items...

``````| eval fieldA=coalesce(fieldA,fieldB,fieldC,fieldD)
| eval fieldA=if(isnotnull(fieldA),fieldA,if(isnotnull(fieldB),fieldB,if(isnotnull(fieldC),fieldC,fieldD)))
| eval fieldA=if(isnull(fieldA),if(isnull(fieldB),if(isnull(fieldC),fieldC,fieldD),fieldB),fieldA)
``````

... and so on...

Legend

Returns the value of abc if it is not null, otherwise defaults to "def" if abc field value is null. You can do the same with if() and case() using isnull() or isnotnull() functions on the field abc.

`````` | eval fieldA= if(isnull(abc),"def",abc)
``````

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ConditionalFunctions

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Legend

The verb `eval` is similar to the way that the word `set` is used in java or c. It flags to splunk that it is supposed to calculate whatever is to the right of the equals sign and assign that value to the variable on the left side of the equals sign.

The verb `coalesce` indicates that the first non-null value is to be used. In this case, it is equivalent to either of the following lines...

``````| eval fieldA=if(isnotnull(abc),abc,"def")
| eval fieldA=if(isnull(abc),"def",abc)
``````

when there are only two values, `coalesce` is not much better than the `if-isnull`, but at three values, the usefulness of `coalesce` becomes obvious, and at four, using anything else is ridiculous.

The following are equivalent for three items...

``````| eval fieldA=coalesce(fieldA,fieldB,fieldC)
| eval fieldA=if(isnotnull(fieldA),fieldA,if(isnotnull(fieldB),fieldB,fieldC))
| eval fieldA=if(isnull(fieldA),if(isnull(fieldB),fieldC,fieldB),fieldA)
``````

The following are equivalent for four items...

``````| eval fieldA=coalesce(fieldA,fieldB,fieldC,fieldD)
| eval fieldA=if(isnotnull(fieldA),fieldA,if(isnotnull(fieldB),fieldB,if(isnotnull(fieldC),fieldC,fieldD)))
| eval fieldA=if(isnull(fieldA),if(isnull(fieldB),if(isnull(fieldC),fieldC,fieldD),fieldB),fieldA)
``````

... and so on...

Super Champion

it would create a field called fieldA and if there was a value in field abc it would use that value, otherwise it would fill in def

http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/ConditionalFunctions#coalesce.28X....

Get Updates on the Splunk Community!

#### New This Month - More Capabilities to Simplify GDI Plus Enhancements in Observability ...

The latest enhancements to the Observability Portfolio deliver more assisted onboarding and expanded content ...

#### Ingest Actions Output Announces Support for File System Destinations

Introduction As part of Splunk Enterprise 9.3, we are proud to announce the general availability of File ...

#### Autoscaling Kubernetes Workloads with Splunk

About What if you had the ability to scale your Kubernetes pods as a result of information output from Splunk? ...