Are you looking for the word NULL in AV_Version or just blank values? If you want to use case then you're missing a couple things... this should work..
eval Severity=case(AV_Version == "NULL", "Informational", AV_Version == "", "Informational")
You can also look at using the isnull() and if() functions...
And you are sure the AVVersion field is being extracted and appears in the events even if it's NULL or blank? For len you would just do ... | eval Severity=if(len(AVVersion)==0,"Informational",AV_Version)
Sorry I dont quite understand... are you confirming the field is being extracted even if it's blank or NULL? If you do just a regular search for null values it returns events? for example: * | where isnull(AV_Version)
Here is the actual search string:
sourcetype="McAfee ePo - All" | sort DAT_Version__VirusScan_Enterprise_ | eval AV_Version=DAT_Version__VirusScan_Enterprise_ | eval Version_Diff=Current_DAT_Version- DAT_Version__VirusScan_Enterprise_ | eval Severity =case( DAT_Version__VirusScan_Enterprise_ = 0, "Informational", DAT_Version__VirusScan_Enterprise_ == "", "Informational", Version_Diff >= 0 AND Version_Diff <= 5, "Low", Version_Diff > 5 AND Version_Diff <= 10, "Medium", Version_Diff > 10, "High", DAT_Version__VirusScan_Enterprise_ = "N/A", "Informational") | table System_Name Last_Communication Current_DAT_Version AV_Version Severity Engine_Version__VirusScan_Enterprise_
Can you edit your post, highlight the search string you have above and click the code button on the menu bar so that it pastes properly and does not apply automatic formatting.