here is the scenario:
http://tinypic.com/r/1ax08/6
how can i delete the events for which the field is empty?
thanks
EDIT:
btw, i do not want to do the "delete" command which would delete the data from the actual server. I just want it removed from the search result
In order to remove events from the search result when field is empty you could just add field=* to your search.
field=*
means "field is anything but empty".
@martin_mueller
How is this right?
For my understanding this means the fields value could by anything.
| where isnull(<field>)
source=
It worked for me