Why are 0 and null values specifically accounted for by the search macro dmc_licensing_base_usage ?

[lycollicott]

The macro consists of this code:

index=_internal source=*license_usage.log type="Usage" | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | bin _time span=1d | stats sum(b) as b by _time, host, pool, s, st, h, idx | search host=$host$ $pool_clause$

It takes into account that some records will have no data for fields h, s and idx. What causes such blank fields in source=*license_usage.log and how do we interpret the "squashed" evaluations?

[somesoni2 · Accepted solution]

Read this (section squashing)

https://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/AboutSplunksLicenseUsageReportView#Split-by...