How to Remove Rows With "NULL"?

[jpfrancetic]

Greetings Splunk Community,

I am currently working on a search and I am trying to drop rows that have "NULL" in them. The problem I am running into is that some of my rows with "NULL" have things like "nullnullNULL" or "nullNULL".  Is there a way i can remove the any row that has the "NULL" value regardless of other info in it?

Thanks in advance!

[PickleRick]

If you want to exclude all events that have the string NULL (case sensitive) anywhere in them, do

| regex _raw!="NULL"

You can also match against single fields