smb2.olb.length == 0 returns any blob length

edit

Neither of these work; implementing either returns zero packets.

Also, the previous two components (filtering by create requests) ensure that each packet returned will have an smb2.olb.length anyways.

I discovered where the failure happens after testing with what was provided, however. SMB2 create requests have multiple Blob Offset values identified, but the display filter for SMB2 does not differentiate between them. This seems to be a limitation of the SMB2 display filter.

Luckily, it appears that smb2.filename is valid, so using a !(smb2.filename == "") works for my purposes.

Not sure what version of Wireshark you're using (can you update the question with wireshark -v).
The What’s New In Wireshark 4.0? blog post describes ways to filter when multiple occurrences of a field exist in a packet.

If there are multiple occurrences of smb2.olb.length in a packet and you want to see all packets where at least one of these occurrences has a non-zero value, you can use the filter smb2.olb.length !== 0 (or smb2.olb.length != 0 in Wireshark up to version 3.4.x and smb2.olb.length ~= 0 in Wireshark version 3.6.x)

So, assuming you're using version 4.0.x, you can use the filter: smb2.cmd == 5 && smb2.flags.response == 0 && smb2.olb.length !== 0