topic delete events that have a certain field empty? in Getting Data In

delete events that have a certain field empty?

halperkins — Thu, 08 Nov 2012 20:51:25 GMT

how can i delete the events for which the field is empty?

thanks

EDIT:
btw, i do not want to do the "delete" command which would delete the data from the actual server. I just want it removed from the search result

sowings — Thu, 08 Nov 2012 21:44:32 GMT

| where isnull(<field>)

gfrjonp — Fri, 09 Nov 2012 02:58:43 GMT

source= | where isnull(B)

martin_mueller — Fri, 09 Nov 2012 14:44:40 GMT

In order to remove events from the search result when field is empty you could just add field=* to your search.

sirisk — Tue, 15 Nov 2016 01:12:44 GMT

It worked for me

horsefez — Tue, 15 Nov 2016 07:02:43 GMT

@martin_mueller
How is this right?
For my understanding this means the fields value could by anything.

martin_mueller — Tue, 15 Nov 2016 17:46:40 GMT

field=* means "field is anything but empty".