Hello;
We ingest IIS logs. Recently some of our iis calls lately haven't included the required username, causing the call to fail. I am trying to find a way in splunk to query the absence of the cs_username field. But, because the field doesn't populate in the iis call when there's no username present, I'm stuck. So searching for a null value does nothing.
I would greatly appreciate any assistance.
