I'm trying to determine whether a field has a value but my search isn't giving me expected results, I've tried this:
search ... | eval agentOrClient = if(detail.agentRefNo == "", "client", "agent") | table agentOrClient
This always returns agent even though the field is blank
I have also tried isnull and that gives the same result
To test for NULL or blank use the following instead:
search ...
| eval agentOrClient = if('detail.agentRefNo' == "" OR isNull('detail.agentRefNo'), "client", "agent")
| table agentOrClient
Also because of the dot in your field name it is a good practise to use single quotes when referring to the field name from within an eval statement.
To test for NULL or blank use the following instead:
search ...
| eval agentOrClient = if('detail.agentRefNo' == "" OR isNull('detail.agentRefNo'), "client", "agent")
| table agentOrClient
Also because of the dot in your field name it is a good practise to use single quotes when referring to the field name from within an eval statement.
perfect, thanks!
No worries. Please don't forget to mark this as answered if you like the response so that others can benefit from it in future.