I have multiple cases with my date:
some have empty src value: e.g,
id=abc src= lr=2
some does not have src at all: e.g.,
and the rest have src with values: e.g.,
id=rty src=df lr=5
The question is how can I separate these three cases? I tried isnull(src) but it does not work.
search | fillnull value=null | stats count by id, src, lr
fillnull will fill empty values even when the field does not exist.