Why "*" start does not include the void value

[michaelteck]

Hello everyone, 

I'm working on Splunk Entreprise and on the Search & Reporting app. 
I made many drop-down menu to filter my data. 
I've a special field who can be "void" and with value. 
How can I make include the void value on the drop-down menu's ? 
Because when I select "*" on the drop-down menu Splunk return all the value of the field but I want to select the "void" value too.

Thanks in advance!

[PickleRick · Accepted solution]

Well, the answer can be "because that's just how Splunk works". And it's important to know that.

If you're matching a field value to something (even if it's a wildcard meaning any value), the field must exist.

If the field does not exist for a given event (which can be also interpreted as the field having null value), it will not match.

It is important because it can cause unexpected results if you're trying to match your events wrongly (because as you noticed, field=* does not mean "regardles of whethere there is any value in that field but means "if there is a value in that field, regardless of what it is - a subtle, yet significant difference).

It also means that matching for field!=value is not the same as matching "NOT field=value". The first condition means that there must be the field and its value must be different from the specified value (which means that the condition won't match an event where there is no field at all!) and the second condition means that either there is a field which has another value or there isn't such field at all.

It's important to learn this distinction because it can make all the difference between searching and finding the right stuff and not finding it.

[ITWhisperer]

"*" means any non-null value. If you want to "include" null values in your filter, you need to remove the filter completely.