Why doesn't fillnull work here?
| rest /servicesNS/-/-/saved/searches splunkserver=local | search disabled=0 isscheduled=1 | fillnull dispatch.earliesttime | table author, title, disabled, isscheduled, cronschedule, search, dispatch.earliesttime, dispatch.latesttime, actions, action.email, action.email.to, action.email.sendresults, alert.track, alert.expires, alerttype, realtime_schedule
dispatch.earliest_time isn't null so
fillnull has nothing to do:
... | eval a1 = if(isnull('dispatch.earliest_time'), "null", "not null")
Weirdly, it's zero-length at the same time:
... | eval a2 = length(tostring('dispatch.earliest_time'))
And it's a string:
... | eval a3 = typeof('dispatch.earliest_time')
As a workaround, you can of course use
eval dispatch.earliest_time = if(length('dispatch.earliest_time')=0, 0, 'dispatch.earliest_time').