Fixing field null expression

[arblade]

The splunk docs mention that field!=* will "never return any events", and that NOT field=* return events where field is null/undefined. After some tests I can confirm that the NOT field=* is returning events where the field is absent (which is the meaning of field: null in sigma, a not existing or empty field).
This splunk discussion confirmed this behavior too.