first you run your search to get the events and add an
eval statement to check if the field exists or not, and if not assign it the value. Try this:
your search here
| eval SSLProxyEngine = case(isnull(SSLProxyEngine), "NONE", isnotnull(SSLProxyEngine), SSLProxyEngine, 1=1, "unknown")
the last option is for events that does not match anything 😉
Hope this helps ...