isempty
The isempty function returns true if the argument is an empty string, array, or object, or is null.
Syntax
isempty( [ Value ] )
Results
A returned boolean value of true indicates that the argument is empty or null.
| x | isempty(x) |
|---|---|
"" | true |
"x" | false |
parse_json("") | true |
parse_json("[]") | true |
parse_json("{}") | true |
Examples
Report on missing events:
dataset="cribl_internal_logs"
| where isempty(stats.eventsFound)Report on empty values in an arbitrary field:
dataset=myDataset
| where isempty(fieldName)