isempty

This page explains how to use the isempty function in APL.

The isempty function returns true if the argument is an empty string or null. Use this function to filter out records with missing or empty string values, validate data completeness, or identify fields that need default values.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

Splunk SPL users

In Splunk SPL, you check for empty values using conditions like field="" or isnull(field). APL’s isempty combines both checks.

Splunk example

| where field="" OR isnull(field)

ANSI SQL users

In ANSI SQL, you check for empty or null values using separate conditions. APL’s isempty provides a more concise approach.

SQL example

SELECT * FROM logs WHERE field IS NULL OR field = '';

Usage

Syntax

isempty(value)

Parameters

Name	Type	Required	Description
value	scalar	Yes	The value to check for emptiness or null.

Returns

Returns true if the value is an empty string or null, otherwise returns false.

Use case examples

Log analysis

Identify HTTP requests with missing or empty geographic information for data quality monitoring.

Query

['sample-http-logs']
| extend has_empty_city = isempty(['geo.city']),
         has_empty_country = isempty(['geo.country'])
| where has_empty_city or has_empty_country
| summarize incomplete_records = count() by has_empty_city, has_empty_country, status
| sort by incomplete_records desc

Run in Playground

Output

has_empty_city	has_empty_country	status	incomplete_records
true	false	200	1234
true	true	404	567
false	true	500	234

This query identifies requests with incomplete geographic data, helping assess data quality and identify potential issues with geo-IP lookups.

List of related functions

• isnotempty: Returns true if a value is not empty and not null. Use this for the inverse check of isempty.
• isnull: Checks only if a value is null. Use this when you specifically need to test for null without checking for empty strings.
• coalesce: Returns the first non-null or non-empty value. Use this to provide default values for empty fields.
• strlen: Returns the length of a string. Use this when you need to check if a string has content beyond just emptiness.