search: case --> field doesn't exist

[LauraBre]

hello,

I have a question about a search with case. This is my search:

source="Laura_acs" |eval Transac=case(ERRL="TIMEOUT_REACHED" OR ERRL="TIMEOUT_REACHED_RECORD","PA Pb fin de session 3D Secure", SD_STAT_PA="NO" AND  (NOT ERRL="TIMEOUT_REACHED" OR NOT ERRL="TIMEOUT_REACHED_RECORD"),"PA Pb Autres",STAT_VE="N","VE No",STAT_VE="Y" AND SD_STAT_PA="Y","PA Yes",STAT_VE="Y" AND SD_STAT_PA="ATTEMPT","PA Attempt",STAT_VE="Y" AND SD_STAT_PA="N", "PA No",STAT_VE="Y","VE sans PA")|DEDUP ID_TRANS|chart count by Transac 

In this search I want for the last case (VE sans PA) that my log line doen't contain field SD_STAT_PA. How can do it? Because, for the moment, STAT_VE="Y" is the selection of all the others case.

Thx by advance,

Laura

[Ayn · Accepted solution]

Use isnull:

isnull(SD_STAT_PA)

[LauraBre]

Thx very much, it works.