Document:Cortex XDR™ XQL Language Reference

Replacenull

Search the Table of Contents

Cortex XDR XQL replacenull stage replaces null field values with a string.

replacenull <field> = <string>

The

replacenull

stage replaces null field values with the specified string. This guarantees that every field in your result set will contain a value.

If you use the

replacenull

stage, then all subsequent stages that refer to the field's null value must use the replacement string.

Return the

action_country

field from every

xdr_data

records where the

action_country

field is null, using the string

N/A

in the place of an empty field value.

dataset = xdr_data 
| fields action_country as ac 
| replacenull ac = "N/A" 
| filter ac = "N/A"