The null value in Cribl Search can indicate:

• The absence of a field or value.
• A type mismatch in a conversion, operation, or function. For example, toint('abc') and 123 / 'hello' both evaluate to null because strings can’t be converted to numbers.

null and Missing Fields ​

When an expression references a field that an event doesn’t contain, Cribl Search returns null for that field instead of dropping the field from the event. This applies to the project, extend, and summarize operators.

For example, the foo field doesn’t exist in the $vt_dummy Dataset, so the following query returns bar as null in every event:

dataset="$vt_dummy" event<5
| project event, bar=foo

Because Cribl Search keeps the field, every event in the results has the same set of fields, whether or not the source data supplied a value. To drop the events that have no value, filter them out with isnotnull.

null Literals ​

A null literal is represented in Cribl Search as null. For example:

• where field==null
• extend result=iff(value > 100, value, null)

null Equality and Inequality ​

Cribl Search supports the null value in equality/inequality comparisons. These comparisons are equivalent to using the isnull and isnotnull functions.

This is different from standard Kusto Query Language (KQL), which returns null if both sides of the comparison are null.

See the following examples:

null and Strings ​

Cribl Search supports the null value in string comparisons.

This is different from standard Kusto Query Langauge (KQL), which does not allow the null value for strings.

See the following examples:

null and Binary Operators ​

Binary operators are those that perform an operation on two values. These operators include and, or, ==, !=, >=, <=, numeric operators (+, -, *), and others.

If one or both of the values passed to the binary operator are null, then the output of the binary operator is also null. For example, null + 10 returns null.

Exceptions to the rule above are:

• For the equality == and inequality != operators, either or both sides of the operation can be null, and will return true or false rather than null (as described in null Equality and Inequality).
• For the logical AND operator, if one of the values is false, the result is also false.
• For the logical OR operator, if one of the values is true, the result is also true.

See the following examples:

null and the where Operator ​

The where operator treats null as false. This means that events with conditions evaluating to null won’t appear in the search results.

For example, dataset="foo" | where tobool("abc") returns no results because tobool("abc") evaluates to null.

null and Distinct Counts ​

The dcount and dcountif aggregation functions don’t count null toward the number of distinct values. If every value in a summary group is null, these functions return 0.

null and the Logical NOT Operator ​

If the value passed to the logical NOT (!) operator is null, then the output is also null.