Hi I would like to search through my events that do not have the field "rerun". I am trying to do something like this:
| search field!=rerun
| search NOT rerun=*
View solution in original post
| fillnull value="foobar" rerun | search rerun="foobar"