How to make empty fields display as Null

[mihall]

I am trying to display results that simply report if a certain field contains information or not.

My search is as follows:
Account_Name=da_* "Certificate Issuer Name" | stats count by user Certificate_Issuer_Name | eval Certificate_Issuer_Name=if(Certificate_Issuer_Name=null, "False", "True")

I think I am searching for this correctly, but it only outputs the values that are true. I think the issue might be that the null values are not registered as "Null" in Splunk. It does not show up when I look for how many values that field has, but I see events that have blank space where that info should be.

Is there any way to get these empty results to display in the report? Or is this an issue with how the data is registering in Splunk?

[cmerriman · Accepted solution]

try this:

Account_Name=da_* "Certificate Issuer Name"| eval Certificate_Issuer_Name=if(isnull(Certificate_Issuer_Name), "False", "True") | stats count by user Certificate_Issuer_Name