How to edit my search to determine if a field has a null or blank value?

[dan_pudwell]

I'm trying to determine whether a field has a value but my search isn't giving me expected results, I've tried this:

search ... | eval agentOrClient = if(detail.agentRefNo == "", "client", "agent") | table agentOrClient

This always returns agent even though the field is blank
I have also tried isnull and that gives the same result

[javiergn · Accepted solution]

To test for NULL or blank use the following instead:

search ... 
| eval agentOrClient = if('detail.agentRefNo' == "" OR isNull('detail.agentRefNo'), "client", "agent") 
| table agentOrClient

Also because of the dot in your field name it is a good practise to use single quotes when referring to the field name from within an eval statement.

[dan_pudwell]

perfect, thanks!

[javiergn]

No worries. Please don't forget to mark this as answered if you like the response so that others can benefit from it in future.