isnull()
Table of Contents
Definition
isnull() takes a value and determines whether or not the value is null. If the value is null, this function returns true.
Examples
The following example adds a new column 'isNull' with eval and adds either 'yes' or 'no' values with if() function if the criteria for isnull() is met. rex4j is used to extract customer IDs in the separate column.
index=sales_inventory earliest=-5y
| rex4j field=_raw "customerId=\"(?<customerId>[a-zA-Z0-9]+-[a-zA-Z0-9]+-[a-zA-Z0-9]+-[a-zA-Z0-9]+-[a-zA-Z0-9]+)"
| eval IsNull=if(isnull(customerId), "yes", "no")
| fields _time customerId isNull