Could anyone explain what does the below search string means ?
| eval fieldA=coalesce(abc, "def")
The verb eval
is similar to the way that the word set
is used in java or c. It flags to splunk that it is supposed to calculate whatever is to the right of the equals sign and assign that value to the variable on the left side of the equals sign.
The verb coalesce
indicates that the first non-null value is to be used. In this case, it is equivalent to either of the following lines...
| eval fieldA=if(isnotnull(abc),abc,"def")
| eval fieldA=if(isnull(abc),"def",abc)
when there are only two values, coalesce
is not much better than the if-isnull
, but at three values, the usefulness of coalesce
becomes obvious, and at four, using anything else is ridiculous.
The following are equivalent for three items...
| eval fieldA=coalesce(fieldA,fieldB,fieldC)
| eval fieldA=if(isnotnull(fieldA),fieldA,if(isnotnull(fieldB),fieldB,fieldC))
| eval fieldA=if(isnull(fieldA),if(isnull(fieldB),fieldC,fieldB),fieldA)
The following are equivalent for four items...
| eval fieldA=coalesce(fieldA,fieldB,fieldC,fieldD)
| eval fieldA=if(isnotnull(fieldA),fieldA,if(isnotnull(fieldB),fieldB,if(isnotnull(fieldC),fieldC,fieldD)))
| eval fieldA=if(isnull(fieldA),if(isnull(fieldB),if(isnull(fieldC),fieldC,fieldD),fieldB),fieldA)
... and so on...
Returns the value of abc if it is not null, otherwise defaults to "def" if abc field value is null. You can do the same with if() and case() using isnull() or isnotnull() functions on the field abc.
| eval fieldA= if(isnull(abc),"def",abc)
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ConditionalFunctions
The verb eval
is similar to the way that the word set
is used in java or c. It flags to splunk that it is supposed to calculate whatever is to the right of the equals sign and assign that value to the variable on the left side of the equals sign.
The verb coalesce
indicates that the first non-null value is to be used. In this case, it is equivalent to either of the following lines...
| eval fieldA=if(isnotnull(abc),abc,"def")
| eval fieldA=if(isnull(abc),"def",abc)
when there are only two values, coalesce
is not much better than the if-isnull
, but at three values, the usefulness of coalesce
becomes obvious, and at four, using anything else is ridiculous.
The following are equivalent for three items...
| eval fieldA=coalesce(fieldA,fieldB,fieldC)
| eval fieldA=if(isnotnull(fieldA),fieldA,if(isnotnull(fieldB),fieldB,fieldC))
| eval fieldA=if(isnull(fieldA),if(isnull(fieldB),fieldC,fieldB),fieldA)
The following are equivalent for four items...
| eval fieldA=coalesce(fieldA,fieldB,fieldC,fieldD)
| eval fieldA=if(isnotnull(fieldA),fieldA,if(isnotnull(fieldB),fieldB,if(isnotnull(fieldC),fieldC,fieldD)))
| eval fieldA=if(isnull(fieldA),if(isnull(fieldB),if(isnull(fieldC),fieldC,fieldD),fieldB),fieldA)
... and so on...
it would create a field called fieldA and if there was a value in field abc it would use that value, otherwise it would fill in def