filtering search results not working as expected

[utoddl]

I have a not-very-complicated query that returns a table of my roles and associated default search indexes. One role has no default search index (srchIndexesDefault), so that role's row contains no value for srchIndexesDefault. So far so good.

Now, I want to filter out rows with no srchIndexesDefault value. Any one of the last three (commented out) lines in this query seem like they should do exactly that. But only the first of the three does. The other two produce no errors, but they also have no apparent effect, and I'd like to understand why. (The results you get from this query will depend on what roles and indexes you have access to.)

| rest /services/authorization/roles 
| mvexpand srchIndexesDefault 
| table title, srchIndexesDefault, defaultApp 
| rename title as roles 
| join roles 
    [| rest /services/authentication/users 
    | search splunk_server=splunksearch* 
    | table title, roles, defaultApp 
    | mvexpand roles ]
| table title, roles, srchIndexesDefault, defaultApp
``` | regex srchIndexesDefault!="^$" ```       ``` <--- This works ```
``` | search srchIndexesDefault=* ```          ``` <--- This doesn't work ```
``` | where isnotnull(srchIndexesDefault) ```  ``` <--- This doesn't work ```

[PickleRick · Accepted solution]

The rest calls returns those fields but the values are empty. So if you do len() on them you'd get a result of zero, not an empty value.

So if you want to find empty values you need to compare the field to a zero-length string.

| search srchIndexesDefault!=""