A collection of useful Splunk SPL

coalesce Returns the first value that is not null coalesce, url_decode, url_decode('https%3a%2f

The coalesce command is essentially a simplified case or if-then-else statement It returns the first of its arguments that is not null

coalesce db2 EVAL-parent_process_guid = case(coalesce == null, null(),

coalesce bigquery coalesce 20:50 - tstats Eval Command In Splunk