Skip to main content
Sumo Logic

isNull, isEmpty, isBlank

isNull Operator

The isNull operator takes a single parameter and returns a Boolean value: True if the variable is indeed null, or false if the variable contains a value other than null.

In addition to isNull, isEmpty can be used to find strings containing no characters or whitespace; isBlank can be used to find strings made up of only whitespace (or is empty or null). Because each of these operators has a specific use, and are very closely related, you'll find them documented together.

When is a field null?

Fields can hold a null value for the following reasons:

  • There is a mismatch from a lookup operator query.
  • There is a missing field from a geo lookup operator query.
  • There is a missing field from a transpose operator query.

When to use isNull, isEmpty, isBlank

isNull(str): Checks if the field value presented is "null".

isNull(null) = true

isNull("") = false

isNull(" ") = false

isNull("bob") = false

isNull(" bob ") = false

Parameters:

str: the String to check, may be null.

Returns:

true if the String is null.

 

isEmpty(str): Checks if the field value is an empty string containing no characters or whitespace.

isEmpty(null) = true

isEmpty("") = true

isEmpty(" ") = false

isEmpty("bob") = false

isEmpty(" bob ") = false

Parameters:

str:The String to check, may be null.

Returns:

true if the String is null or empty.

 

isBlank(str) : Checks if the field value is a null, an empty string or a string containing only whitespace characters.

isBlank(null) = true

isBlank("") = true

isBlank(" ") = true

isBlank("bob") = false

isBlank(" bob ") = false

Parameters:

str: The String to check, may be null.

Returns:

true if the String is null, empty or whitespace.

Examples

isNull: Run a geo lookup query where we can find remote IP addresses that are not in the geo database.

In this situation, no country_code will be associated with the IP address (this field would be null).

Running a query like:

| parse "remote_ip=*]" as remote_ip
| lookup country_code from geo://default on ip = remote_ip
| if (isNull(country_code), "unknown", country_code) as country_code

returns results similar to:

isNull

Use where to check for null values.

To check for null values from a lookup operation, use a query like:

| parse "example_ip=*]" as ip
| lookup country_name, city from geo://default on ip = ip
| where isNull(country_name)