https://community.splunk.com/t5/Getting-Data-In/filtering-search-results-not-working-as-expected/m-p/753116#M119581 <P>The rest calls returns those fields but the values are empty. So if you do len() on them you'd get a result of zero, not an empty value.</P><P>So if you want to find empty values you need to compare the field to a zero-length string.</P><PRE>| search srchIndexesDefault!=""</PRE> Mon, 15 Sep 2025 19:07:39 GMT PickleRick 2025-09-15T19:07:39Z https://community.splunk.com/t5/Getting-Data-In/filtering-search-results-not-working-as-expected/m-p/753108#M119576 <P>I have a not-very-complicated query that returns a table of my roles and associated default search indexes. One role has no default search index (srchIndexesDefault), so that role's row contains no value for srchIndexesDefault. So far so good.</P><P>Now, I want to filter out rows with no srchIndexesDefault value. Any one of the last three (commented out) lines in this query seem like they should do exactly that. But only the first of the three does. The other two produce no errors, but they also have no apparent effect, and I'd like to understand why. (The results you get from this query will depend on what roles and indexes you have access to.)</P><LI-CODE lang="markup">| rest /services/authorization/roles | mvexpand srchIndexesDefault | table title, srchIndexesDefault, defaultApp | rename title as roles | join roles [| rest /services/authentication/users | search splunk_server=splunksearch* | table title, roles, defaultApp | mvexpand roles ] | table title, roles, srchIndexesDefault, defaultApp ``` | regex srchIndexesDefault!="^$" ``` ``` &lt;--- This works ``` ``` | search srchIndexesDefault=* ``` ``` &lt;--- This doesn't work ``` ``` | where isnotnull(srchIndexesDefault) ``` ``` &lt;--- This doesn't work ```</LI-CODE><P>&nbsp;</P> Mon, 15 Sep 2025 15:46:06 GMT https://community.splunk.com/t5/Getting-Data-In/filtering-search-results-not-working-as-expected/m-p/753108#M119576 utoddl 2025-09-15T15:46:06Z https://community.splunk.com/t5/Getting-Data-In/filtering-search-results-not-working-as-expected/m-p/753116#M119581 <P>The rest calls returns those fields but the values are empty. So if you do len() on them you'd get a result of zero, not an empty value.</P><P>So if you want to find empty values you need to compare the field to a zero-length string.</P><PRE>| search srchIndexesDefault!=""</PRE> Mon, 15 Sep 2025 19:07:39 GMT https://community.splunk.com/t5/Getting-Data-In/filtering-search-results-not-working-as-expected/m-p/753116#M119581 PickleRick 2025-09-15T19:07:39Z