Splunk Search

how to set null value ?

WXY
Path Finder

If the field value is null, the value is null, and if it is not controlled, it is still the original value

I want to get a field value ,if it is null ,I set it null,if not ,I hope it still the original value

I use :

index = abc_text  | eval Codelocation = if(isnull(Codelocation), "null",Codelocation)|stats  max(_time) as _time  values(Codelocation) as codelocation by source

It did not achieve the desired effect.

Tags (3)
0 Karma

zihenggong
Engager

use null() instead of "null"

renjith_nair
Legend

@WXY, just a clarification - if the value is null why do you want to set it again to null ? Do you mean you want to convert "space" to null.

Anyway try this |eval Codelocation = if(isnull(Codelocation), null(),Codelocation)

Happy Splunking!
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...