All Apps and Add-ons

Does Splunk have a NVL-like function or feature?

suhprano
Path Finder

Is it possible to return a 0 or -1 for null subsearch matches in splunk?

sourcetype=log1 [search sourcetype=log2|fields id|dedup id]|fields id,status |sort id

This gives me all id and status entries from log1 that match all the ids in log2, but if there are no log2 ids matching in log1, is it possible to report/create a dummy entry with a default value in the result set?

Tags (2)
1 Solution

Ayn
Legend

There is indeed a NVL equivalent in the Splunk search language. It is called fillnull. More information on that command is available here: http://www.splunk.com/base/Documentation/latest/SearchReference/Fillnull

View solution in original post

jamesdaily
Explorer

COALESCE is the ANSI standard SQL function equivalent to Oracle NVL. Unlike NVL, COALESCE supports more than two fields in the list.

In Splunk, coalesce() returns the value of the first non-null field in the list.

Here's an example where you'd get the Preferred_Name if it's present, otherwise use the First_name if it's present, and if both of those are null, then just use the word "Friend". If you didn't include a default at the end, and both fields were blank, you'd just get a blank.

eval name_to_use=coalesce(preferred_name,first_name,"Friend")| table name_to_use

0 Karma

Ayn
Legend

There is indeed a NVL equivalent in the Splunk search language. It is called fillnull. More information on that command is available here: http://www.splunk.com/base/Documentation/latest/SearchReference/Fillnull

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...