https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-determine-if-a-field-has-a-null-or/m-p/276069#M83279 <P>I'm trying to determine whether a field has a value but my search isn't giving me expected results, I've tried this:</P> <PRE><CODE>search ... | eval agentOrClient = if(detail.agentRefNo == "", "client", "agent") | table agentOrClient </CODE></PRE> <P>This always returns agent even though the field is blank<BR /> I have also tried isnull and that gives the same result</P> Fri, 03 Feb 2017 10:52:01 GMT dan_pudwell 2017-02-03T10:52:01Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-determine-if-a-field-has-a-null-or/m-p/276069#M83279 <P>I'm trying to determine whether a field has a value but my search isn't giving me expected results, I've tried this:</P> <PRE><CODE>search ... | eval agentOrClient = if(detail.agentRefNo == "", "client", "agent") | table agentOrClient </CODE></PRE> <P>This always returns agent even though the field is blank<BR /> I have also tried isnull and that gives the same result</P> Fri, 03 Feb 2017 10:52:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-determine-if-a-field-has-a-null-or/m-p/276069#M83279 dan_pudwell 2017-02-03T10:52:01Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-determine-if-a-field-has-a-null-or/m-p/276070#M83280 <P>To test for NULL or blank use the following instead:</P> <PRE><CODE>search ... | eval agentOrClient = if('detail.agentRefNo' == "" OR isNull('detail.agentRefNo'), "client", "agent") | table agentOrClient </CODE></PRE> <P>Also because of the dot in your field name it is a good practise to use single quotes when referring to the field name from within an eval statement.</P> Fri, 03 Feb 2017 11:20:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-determine-if-a-field-has-a-null-or/m-p/276070#M83280 javiergn 2017-02-03T11:20:36Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-determine-if-a-field-has-a-null-or/m-p/276071#M83281 <P>perfect, thanks!</P> Fri, 03 Feb 2017 11:29:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-determine-if-a-field-has-a-null-or/m-p/276071#M83281 dan_pudwell 2017-02-03T11:29:25Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-determine-if-a-field-has-a-null-or/m-p/276072#M83282 <P>No worries. Please don't forget to mark this as answered if you like the response so that others can benefit from it in future.</P> Fri, 03 Feb 2017 11:50:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-determine-if-a-field-has-a-null-or/m-p/276072#M83282 javiergn 2017-02-03T11:50:32Z