what does the coalesce and eval in my query do?

[pavanae]

Could anyone explain what does the below search string means ?

| eval fieldA=coalesce(abc, "def")

[niketn]

Returns the value of abc if it is not null, otherwise defaults to "def" if abc field value is null. You can do the same with if() and case() using isnull() or isnotnull() functions on the field abc.

 | eval fieldA= if(isnull(abc),"def",abc) 

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ConditionalFunctions

[DalJeanis · Accepted solution]

The verb eval is similar to the way that the word set is used in java or c. It flags to splunk that it is supposed to calculate whatever is to the right of the equals sign and assign that value to the variable on the left side of the equals sign.

The verb coalesce indicates that the first non-null value is to be used. In this case, it is equivalent to either of the following lines...

| eval fieldA=if(isnotnull(abc),abc,"def")
| eval fieldA=if(isnull(abc),"def",abc)

when there are only two values, coalesce is not much better than the if-isnull, but at three values, the usefulness of coalesce becomes obvious, and at four, using anything else is ridiculous.

The following are equivalent for three items...

| eval fieldA=coalesce(fieldA,fieldB,fieldC)
| eval fieldA=if(isnotnull(fieldA),fieldA,if(isnotnull(fieldB),fieldB,fieldC))
| eval fieldA=if(isnull(fieldA),if(isnull(fieldB),fieldC,fieldB),fieldA)

The following are equivalent for four items...

| eval fieldA=coalesce(fieldA,fieldB,fieldC,fieldD)
| eval fieldA=if(isnotnull(fieldA),fieldA,if(isnotnull(fieldB),fieldB,if(isnotnull(fieldC),fieldC,fieldD)))
| eval fieldA=if(isnull(fieldA),if(isnull(fieldB),if(isnull(fieldC),fieldC,fieldD),fieldB),fieldA)

... and so on...

[cmerriman]

it would create a field called fieldA and if there was a value in field abc it would use that value, otherwise it would fill in def

http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/ConditionalFunctions#coalesce.28X....