Skip to main content
Panther Knowledge Base

What is the best way to query for all NULL or non-NULL values in Panther?

  1. Last updated
  2. Save as PDF

QUESTION

How can I find all occurrences of a NULL value (or conversely, all non-NULL occurrences) in a Panther scheduled query, in the Search tool, or in an ad-hoc Data Explorer search?

ANSWER

While using the Search tool to create a search filter, use the is null or is not null operators.

To perform a comparison to NULL in a query (via Data Explorer or a Scheduled Query), use the IS operator:

SELECT * FROM table WHERE column IS NULL
  -- or --
SELECT * FROM table WHERE column IS NOT NULL

Note that using the usual equality operators = or !=will return no results. This is because any equality operators involving a NULL value will return NULLthemselves, and thus be excluded from the result set.

For more information on how to handle NULLvalues, consult Snowflake's documentation here.