PPL condition functions
Note
To see which AWS data source integrations support this PPL function, see Functions.
ISNULL
Description:
isnull(field) returns true if the field is null.
Argument type:
-
All supported data types.
Return type:
-
BOOLEAN
Example:
os> source=accounts | eval result = isnull(employer) | fields result, employer, firstname fetched rows / total rows = 4/4 +----------+-------------+-------------+ | result | employer | firstname | |----------+-------------+-------------| | False | AnyCompany | Mary | | False | ExampleCorp | Jane | | False | ExampleOrg | Nikki | | True | null | Juan | +----------+-------------+-------------+
ISNOTNULL
Description:
isnotnull(field) returns true if the field is not
null.
Argument type:
-
All supported data types.
Return type:
-
BOOLEAN
Example:
os> source=accounts | where not isnotnull(employer) | fields account_number, employer fetched rows / total rows = 1/1 +------------------+------------+ | account_number | employer | |------------------+------------| | 18 | null | +------------------+------------+
EXISTS
Example:
os> source=accounts | where exists(email) | fields account_number, email fetched rows / total rows = 1/1
IFNULL
Description: ifnull(field1,
field2) returns field2 if field1 is
null.
Argument type:
-
All supported data types.
-
If the two parameters have different types, the function will fail the semantic check.
Return type:
-
Any
Example:
os> source=accounts | eval result = ifnull(employer, 'default') | fields result, employer, firstname fetched rows / total rows = 4/4 +------------+------------+-------------+ | result | employer | firstname | |------------+------------+-------------| | AnyCompany | AnyCompany | Mary | | ExampleCorp| ExampleCorp| Jane | | ExampleOrg | ExampleOrg | Nikki | | default | null | Juan | +------------+------------+-------------+
NULLIF
Description: nullif(field1,
field2) return null if two parameters are same, otherwise return
field1.
Argument type:
-
All supported data types.
-
If the two parameters have different types, the function will fail the semantic check.
Return type:
-
Any
Example:
os> source=accounts | eval result = nullif(employer, 'AnyCompany') | fields result, employer, firstname fetched rows / total rows = 4/4 +----------------+----------------+-------------+ | result | employer | firstname | |----------------+----------------+-------------| | null | AnyCompany | Mary | | ExampleCorp | ExampleCorp | Jane | | ExampleOrg | ExampleOrg | Nikki | | null | null | Juan | +----------------+----------------+-------------+
IF
Description: if(condition,
expr1, expr2) returns expr1 if the condition is
true, otherwise it returns expr2.
Argument type:
-
All supported data types.
-
If the two parameters have different types, the function will fail the semantic check.
Return type:
-
Any
Example:
os> source=accounts | eval result = if(true, firstname, lastname) | fields result, firstname, lastname fetched rows / total rows = 4/4 +----------+-------------+----------+ | result | firstname | lastname | |----------+-------------+----------| | Jane | Jane | Doe | | Mary | Mary | Major | | Pat | Pat | Candella | | Dale | Jorge | Souza | +----------+-----------+------------+ os> source=accounts | eval result = if(false, firstname, lastname) | fields result, firstname, lastname fetched rows / total rows = 4/4 +----------+-------------+------------+ | result | firstname | lastname | |----------+-------------+------------| | Doe | Jane | Doe | | Major | Mary | Major | | Candella | Pat | Candella | | Souza | Jorge | Souza | +----------+-------------+------------+ os> source=accounts | eval is_vip = if(age > 30 AND isnotnull(employer), true, false) | fields is_vip, firstname, lastname fetched rows / total rows = 4/4 +----------+-------------+------------+ | is_vip | firstname | lastname | |----------+-------------+------------| | True | Jane | Doe | | True | Mary | Major | | False | Pat | Candella | | False | Jorge | Souza | +----------+-------------+------------+
