How to use coalesce function in SPL

Double quotes make splunk think the value is a literal string, rather than a field Use single quotes in your coalesce instead, and you should

coalesce The first value that is not NULL, coalesce(null(), Returned val, null()) cos, Cosine of X, n=cos #12 exact

coalesce معنى splunk logo Splunk datadog logo Datadog new relic logo New Relic snowflake coalesce · concat · constants · env · format · join · json_decode · json_path

coalesce synonyms Here's an updated table with example queries that utilize the respective Splunk commands: Splunk Command, Description, Example Query (Apache