What does the below coalesce command mean in this Splunk search? Any explanation would be appreciated
eval fieldA=coalesce(fieldA,"")
The coalesce
command is essentially a simplified case or if-then-else statement. It returns the first of its arguments that is not null. In your example, fieldA is set to the empty string if it is null. See http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/CommonEvalFunctions.
Hi pavanae,
are you sure that this function runs?
every way, coalesce "takes an arbitrary number of arguments and returns the first value that is not null", so there is no sense to put a null value in this function (see http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/CommonEvalFunctions).
If you want to give to FieldA a different value when it's null, you have to use eval FieldA=if(isnull(FieldA),"X",FieldA)
.
Bye.
Giuseppe
An empty string ("") is not the same as a null value.
The coalesce
command is essentially a simplified case or if-then-else statement. It returns the first of its arguments that is not null. In your example, fieldA is set to the empty string if it is null. See http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/CommonEvalFunctions.