The missing function provides a filter for events that do not contain any data in one or more fields.
The parameters to the missing function are field names. Any number of field names can be specified. For example:
missing(dstcity)
Result: would return only results that do not include a populated dstcity field.
missing(dstcity,srccity)
Result: would return only results that did not include a populated dstcity field as well as a populated srccity field.
Note
The only syntax that works for rules is
missing:field ormissing=field. There are no limitations for search.
Note
The legacy
missing:field andmissing=field syntax is deprecated as of TQL 2.0.