isempty function returns true if the argument is an empty string or null. Use this function to filter out records with missing or empty string values, validate data completeness, or identify fields that need default values.
For users of other query languages
If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.Splunk SPL users
Splunk SPL users
In Splunk SPL, you check for empty values using conditions like
field="" or isnull(field). APL’s isempty combines both checks.ANSI SQL users
ANSI SQL users
In ANSI SQL, you check for empty or null values using separate conditions. APL’s
isempty provides a more concise approach.Usage
Syntax
Parameters
Returns
Returnstrue if the value is an empty string or null, otherwise returns false.
Use case examples
- Log analysis
- OpenTelemetry traces
- Security logs
Identify HTTP requests with missing or empty geographic information for data quality monitoring.QueryRun in PlaygroundOutput
This query identifies requests with incomplete geographic data, helping assess data quality and identify potential issues with geo-IP lookups.
List of related functions
- isnotempty: Returns true if a value is not empty and not null. Use this for the inverse check of isempty.
- isnull: Checks only if a value is null. Use this when you specifically need to test for null without checking for empty strings.
- coalesce: Returns the first non-null or non-empty value. Use this to provide default values for empty fields.
- strlen: Returns the length of a string. Use this when you need to check if a string has content beyond just emptiness.