It actually works as expected, don't forget that splunk will run your pipes one by one, searches is not compiled.
If we take this search
(1)
(2) | eval name=if(id="xyz", "unknown", name)
At (1) your field name will only exists where there is a value, for all rows, it will not be blank, it will not exist and hence be null so at step (2) you will assign null to you field name
If you add a fill null between
(1)
(2) | fillnull value="" name
(3) | eval name=if(id="xyz", "unknown", name)
now at step (2) you field name exist and is set to blank (or whatever value you set).
... View more