topic Why is ISNULL functionality not working? in Splunk Search https://community.splunk.com/t5/Splunk-Search/Why-is-ISNULL-functionality-not-working/m-p/640180#M221831 <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Keerthi_0-1681721858028.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/24943i1F3CE35786247C5F/image-size/medium?v=v2&amp;px=400" role="button" title="Keerthi_0-1681721858028.png" alt="Keerthi_0-1681721858028.png" /></span></P> <P>I am trying to get the data only when my lastlogon(field name) is Null. but the above query is still giving me data for both Null and non Null values.</P> Tue, 18 Apr 2023 09:01:51 GMT Keerthi 2023-04-18T09:01:51Z Why is ISNULL functionality not working? https://community.splunk.com/t5/Splunk-Search/Why-is-ISNULL-functionality-not-working/m-p/640180#M221831 <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Keerthi_0-1681721858028.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/24943i1F3CE35786247C5F/image-size/medium?v=v2&amp;px=400" role="button" title="Keerthi_0-1681721858028.png" alt="Keerthi_0-1681721858028.png" /></span></P> <P>I am trying to get the data only when my lastlogon(field name) is Null. but the above query is still giving me data for both Null and non Null values.</P> Tue, 18 Apr 2023 09:01:51 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-ISNULL-functionality-not-working/m-p/640180#M221831 Keerthi 2023-04-18T09:01:51Z Re: ISNULL functionality not working https://community.splunk.com/t5/Splunk-Search/Why-is-ISNULL-functionality-not-working/m-p/640187#M221835 <P>Field name are case-sensitive - try this</P><LI-CODE lang="markup">| where isnull(LASTLOGON)</LI-CODE> Mon, 17 Apr 2023 09:56:03 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-ISNULL-functionality-not-working/m-p/640187#M221835 ITWhisperer 2023-04-17T09:56:03Z Re: Why is ISNULL functionality not working? https://community.splunk.com/t5/Splunk-Search/Why-is-ISNULL-functionality-not-working/m-p/640402#M221920 <P>Fields are case sensitive and also sometimes "empty" (i.e. == "").&nbsp; You can check for both like this:<BR /><BR /><SPAN>(isnull(LASTLOGON) OR LASTLOGON=="")</SPAN></P> Tue, 18 Apr 2023 18:21:16 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-ISNULL-functionality-not-working/m-p/640402#M221920 woodcock 2023-04-18T18:21:16Z