All Apps and Add-ons

Splunk DB Connect 2: NULL-fields returned as 'NULL'-string, blank fields returned as actual NULL

TheSwiney
Engager

Hi all,

My database table has a column that seems to have both NULL and empty values in it. In TOAD it shows as:

alt text

When querying the database with DB Connect 2 | dbxquery connection=nulltest output=csv shortnames=true maxrows=0 query="select * from subscribers where username = ''" , the NULL-fields seem to have become strings, while the blank values look empty.

alt text

I could live with this if Splunk interpreted the NULL-strings as actual null-values; however, when I try to select all rows with null-values - where isnull(authentication_url) - only the rows that initially were blanks are returned.

Is there a way to avoid this behaviour? Possibly in the settings, and preferably without having to fill all field with alternative values to correct the behaviour?

0 Karma
1 Solution

jcoates_splunk
Splunk Employee
Splunk Employee

Hi,

this will be reverted to "NULL = blank" in the next release, which is coming soon; in the meantime I'm afraid that there isn't a way to select behavior.

The intention was to behave like SQL clients which display null indications in their UI, on the assumption that it would be easy to use eval to alter the data for use, but the feedback we've gotten is that it would be better for most users not to do that.

View solution in original post

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

Hi,

this will be reverted to "NULL = blank" in the next release, which is coming soon; in the meantime I'm afraid that there isn't a way to select behavior.

The intention was to behave like SQL clients which display null indications in their UI, on the assumption that it would be easy to use eval to alter the data for use, but the feedback we've gotten is that it would be better for most users not to do that.

0 Karma

MaverickT
Communicator

Thanks for the information. What ETA for the next release?

0 Karma

TheSwiney
Engager

Thanks! We'll work around the issue for the time being, but happy a fix is coming soon.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...