Skip to main content

isNull, isEmpty, isBlank Search Operators

  • The isNull operator checks a string and returns a boolean value: true if the string is null, or false if the string is not null.
  • The isEmpty operator checks if a string contains no characters and is only whitespace.
  • The isBlank operator checks if a string contains no characters, is only whitespace, and is null.

When is a field null?

Fields can hold a null value for the following reasons:

  • A parsing operation failed to parse a value.
  • There is a mismatch from a lookup operator query.
  • There is a missing field from a geo lookup operator query.
  • There is a missing field from a transpose operator query.

When to use isNull, isEmpty, isBlank

isNull(<string>)

Checks if the <string> value is "null".

  • isNull(null) = true
  • isNull("") = false
  • isNull(" ") = false
  • isNull("bob") = false
  • isNull(" bob ") = false

Returns true if the string is null.

isEmpty(<string>)

Checks if the <string> value is an empty string containing no characters or whitespace.

  • isEmpty(null) = true
  • isEmpty("") = true
  • isEmpty(" ") = false
  • isEmpty("bob") = false
  • isEmpty(" bob ") = false

Returns true if the string is null or empty.

isBlank(<string>)

Checks if the value is null, empty, or contains only whitespace characters.

  • isBlank(null) = true
  • isBlank("") = true
  • isBlank(" ") = true
  • isBlank("bob") = false
  • isBlank(" bob ") = false

Returns true if the string is null, empty, or only whitespace.

Examples

Run a geo lookup query where we can find remote IP addresses that are not in the geo database.

In this situation, no country_code will be associated with the IP address and the field value will be null.

Running a query like:

| parse "remote_ip=*]" as remote_ip
| lookup country_code from geo://location on ip = remote_ip
| if (isNull(country_code), "unknown", country_code) as country_code

uses the isNull operator to check the field value of country_code and if it returns true has the if operator replace the value with the string unknown:

isNull

Use where to check for null values.

To check for null values from a lookup operation, use a query like:

| parse "example_ip=*]" as ip
| lookup country_name, city from geo://location on ip = ip
| where isNull(country_name)
Sumo Logic YouTubeSumo Logic Twitter
Legal
Privacy Statement
Terms of Use

Copyright © 2022 by Sumo Logic, Inc.