I am trying to display results that simply report if a certain field contains information or not.
My search is as follows:
AccountName=da* "Certificate Issuer Name" | stats count by user CertificateIssuerName | eval CertificateIssuerName=if(CertificateIssuerName=null, "False", "True")
I think I am searching for this correctly, but it only outputs the values that are true. I think the issue might be that the null values are not registered as "Null" in Splunk. It does not show up when I look for how many values that field has, but I see events that have blank space where that info should be.
Is there any way to get these empty results to display in the report? Or is this an issue with how the data is registering in Splunk?