Seprating null and empty fields

[gimbil]

Hi All,

I have multiple cases with my date:
some have empty src value: e.g,
id=abc src= lr=2
some does not have src at all: e.g.,
id=cde lr=5
and the rest have src with values: e.g.,
id=rty src=df lr=5

The question is how can I separate these three cases? I tried isnull(src) but it does not work.

Thanks

[lukejadamec]

Try:

search | fillnull value=null | stats count by id, src, lr

fillnull will fill empty values even when the field does not exist.