Matching blanks on Notification or Escalation filter can be done by leaving matching criteria empty.
For example:
Matching all ticket ID that are empty:
Attribute: Ticket ID matches
Matching all ticket ID that are closed or empty:
Attribute: Ticket ID matches *CLOSED*|
The '|' (or) is needed to match on null string (blanks)
However, when trying to match blanks and using '~' and '|', There ~ filter out blanks as well.
Example:
Matching Element Name that are empty or not something:
Attribute: Element Name matches ~10.9.1.1|~moto-gw.smarts.com|
The '|' (or) is meaning less, it will filter out events with empty "Element Name", so when using ~ and still show events with "empty string" match, you will need to separate ~10.9.1.1 and ~moto-gw.smarts.com into two separate filter statements.