2015-01-30 12:43 PM
Is anyone aware if its possible to query NULL, or empty values through the event investigation navigator in 10.3 SA?
I have tried the following, but nothing is working.
user.dst=''
user.dst=' '
user.dst=NULL
user.dst='NULL'
2015-01-30 02:03 PM
in don't think in 10.3 is possible tu use that option. in 10.4 you can use !exists clause
In the ESA you can use NOT NULL in the advanced mode.
