here is the scenario:
how can i delete the events for which the field is empty?
btw, i do not want to do the "delete" command which would delete the data from the actual server. I just want it removed from the search result
| where isnull(<field>)
source= | where isnull(B)
It worked for me
In order to remove events from the search result when field is empty you could just add field=* to your search.
How is this right?
For my understanding this means the fields value could by anything.
field=* means "field is anything but empty".