Onion Query Language Null

[Ryan8bit]

How do I specify in Onion Query Language (for the Hunt Interface queries) that the event.module is null?

!(event.module: ) | groupby event.module
does not work

[dougburks]

Is this what you're looking for?

-_exists_:event.module

[Ryan8bit]

If the event.module field is blank, is -exists:event.module true or false?

[dougburks]

If you search SOC for -_exists_:event.module, it should show logs that do NOT have the event.module field.

If you remove the hypen and search for _exists_:event.module, it should show logs that DO have the event.module field.

[Ryan8bit]

How do I remove items with a blank event.module field?

[dougburks]

Depending on your data, one option might be to OR the desired modules like this:

_exists_:event.module AND (event.module:module1 OR event.module:module2 OR event.module:module3)

[Ryan8bit]

This is useful. That option is a useful workaround. Thanks!