How to edit my search to find a combination of null (using fillnull) and other specific values in a multivalue field?

[zsplunka]

I have a database with multiple fields, one being a phone number field that has a ton of phone numbers. But certain values in this phone number field are the ones i am interested in and they include the blank values and also ones that contain entries including phone=9999999999 and phone=7777777777 in addition to real phone numbers. My goal is to count the ones that have these blanks or other 9999999999 and not the real phone numbers so trying to craft logic accordingly. I have established the first part of search in putting in NO for blank values, but have been unable to combine these other values i need to count.

Search(this works for the blank values):

sourcetype=database (result="'success'" OR result="success") | fillnull value=NO  CM_MOB_PHONE_NO CM_HOME_PHONE_NO CM_SMS_PHONE_NO | search CM_MOB_PHONE_NO=NO CM_SMS_PHONE_NO=NO CM_HOME_PHONE_NO=NO 

BUT, I need to include these values in the search as well to basically filter out all the real phone numbers:

(CM_MOB_PHONE_NO=”9999999999” OR CM_MOB_PHONE_NO=”7777777777” OR CM_MOB_PHONE_NO=”5555555555” OR CM_MOB_PHONE_NO=”3333333333” OR CM_MOB_PHONE_NO=”0000000000”)
(CM_HOME_PHONE_NO=”9999999999” OR CM_HOME_PHONE_NO=”7777777777” OR CM_HOME_PHONE_NO=”5555555555” OR CM_HOME_PHONE_NO=”3333333333” OR CM_HOME_PHONE_NO=”0000000000”)
(CM_SMS_PHONE_NO=”9999999999” OR CM_SMS_PHONE_NO=”7777777777” CM_SMS_PHONE_NO=”5555555555” OR CM_SMS_PHONE_NO=”3333333333” OR CM_SMS_PHONE_NO=”0000000000”)

Any help is appreciated on fixing this search. Thank you!

[woodcock · Accepted solution]

Like this:

sourcetype=database (result="'success'" OR result="success") CM_MOB_PHONE_NO!="*" OR CM_HOME_PHONE_NO!="*" OR CM_SMS_PHONE_NO!="*" OR CM_MOB_PHONE_NO=”9999999999” OR CM_MOB_PHONE_NO=”7777777777” OR CM_MOB_PHONE_NO=”5555555555” OR CM_MOB_PHONE_NO=”3333333333” OR CM_MOB_PHONE_NO=”0000000000” OR CM_HOME_PHONE_NO=”9999999999” OR CM_HOME_PHONE_NO=”7777777777” OR CM_HOME_PHONE_NO=”5555555555” OR CM_HOME_PHONE_NO=”3333333333” OR CM_HOME_PHONE_NO=”0000000000” OR CM_SMS_PHONE_NO=”9999999999” OR CM_SMS_PHONE_NO=”7777777777” CM_SMS_PHONE_NO=”5555555555” OR CM_SMS_PHONE_NO=”3333333333” OR CM_SMS_PHONE_NO=”0000000000”