https://devhubby.com/thread/how-to-check-null-in-splunk