isnotempty function returns true if the argument isn’t an empty string and isn’t null. Use this function to filter for records with valid, non-empty values, ensure data quality, or validate that required fields contain actual content.
For users of other query languages
If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.Splunk SPL users
Splunk SPL users
In Splunk SPL, you check for non-empty values using conditions like
field!="" and isnotnull(field). APL’s isnotempty combines both checks.ANSI SQL users
ANSI SQL users
In ANSI SQL, you check for non-empty and non-null values using separate conditions. APL’s
isnotempty provides a more concise approach.Usage
Syntax
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| value | scalar | Yes | The value to check for non-emptiness and non-null. |
Returns
Returnstrue if the value is not an empty string and not null, otherwise returns false.
Use case examples
- Log analysis
- OpenTelemetry traces
- Security logs
Filter HTTP logs to only include requests with valid geographic information for accurate location-based analytics.QueryRun in PlaygroundOutput
This query filters requests to only include those with complete geographic information, ensuring accurate location-based analysis without null or empty values.
| geo.city | geo.country | request_count |
|---|---|---|
| New York | United States | 2341 |
| London | United Kingdom | 1987 |
| Tokyo | Japan | 1654 |
| Paris | France | 1432 |
List of related functions
- isempty: Returns true if a value is empty or null. Use this for the inverse check of isnotempty.
- isnotnull: Checks only if a value is not null. Use this when you specifically need to test for null without checking for empty strings.
- strlen: Returns the length of a string. Use this when you need to ensure strings have minimum content length beyond just being non-empty.
- coalesce: Returns the first non-null or non-empty value. Use this to select from multiple fields or provide defaults.