Show only null result

[Miguel3393]

How can I make it show me only what appears as null in the Call.CallForwardInfo.OriginalCalledAddr field? Right now I have this result, you can help me.

[zksvc]

Maybe you can add all your condition in 1 line ? 

| where isnull(cliente) AND isnull(cliente1) AND Call.CallForwardInfo.OriginalCalledAddr="null"

 Let me know if it works

[Miguel3393]

Hi,

It was added in the following way and it did not work, it does not show results.

index="cdr_cfs_index"
| search Call.OrigParty.TrunkGroup.TrunkGroupId=2601
| lookup ClientesSymSipdfntion1 Call.OrigParty.CallingPartyAddr OUTPUT cliente
| lookup ClientesSymSipdfntion2 Call.OrigParty.CallingPartyAddr OUTPUT cliente1
| fillnull value=null Call.CallForwardInfo.OriginalCalledAddr | where isnull(cliente) AND isnull(cliente1) AND Call.CallForwardInfo.OriginalCalledAddr="null"
| stats count by Call.OrigParty.CallingPartyAddr Call.CallForwardInfo.OriginalCalledAddr
| sort - Call.CallForwardInfo.OriginalCalledAddr

[richgalloway]

Add | where Call.CallForwardInfo.OriginalCalledAddr="null" to the query.

[Miguel3393]

I added it but it doesn't work, it doesn't show results.