Can someone help me understand why "NOT [search...]" is used in this search string?

[IRHM73]

Hi, I wonder whether someone could help me please.

I've been presented with the following search, and although as a beginner I understand most of it, I'm having difficulty in working out the intention of the NOT search element.

auditSource=ts  detail.cofcEventType=*  NOT [search auditSource=ts auditType=RenewalCompleted]| stats count by auditType

I've trawled through the Splunk documentation many times and a host of posts, but I'm still none the wiser.

I just wondered whether someone may be able to advise me on what the author of the search is trying to achieve and the reason behind using the 'NOT search' operators.

Many thanks and kind regards

Chris

[somesoni2 · Accepted solution]

This is how you should read the query

auditSource=ts  detail.cofcEventType=*  NOT [search auditSource=ts auditType=RenewalCompleted]| stats count by auditType
|-----------base search-------------|   |---------Filter search/subsearch-------------------|  |--- transformation/aggregation--|

The base search will select certain events, the filter will remove certain events from the results of base search, transformation/aggregation will be applied on the filtered events.

Unrelated, this is how you can rewrite the search for more readability

 auditSource=ts  detail.cofcEventType=*  NOT auditType=RenewalCompleted| stats count by auditType

[IRHM73]

Hi @somesoni2, thank you very much for taking the time to reply to my post and for the clear explanation.

Once again many thanks and kind regards

Chris

[ohlafl]

The NOT statement in front of the subsearch will result in the main search returning events that do not contain the result of the subsearch. It is very litteral.

Consider the following example:

index=food foodtype=icecream topping=sprinkles

... will result in all events containing icecream with sprinkles.

index=food foodtype=icecream NOT topping=sprinkles

... will result in all events containing icecreams but not the ones that have sprinkle as topping.

[IRHM73]

Hi @ohlafi, I really appreciate you taking the time to reply to my post with a good explanation. Very much appreciated.

Kind Regards

Chris

[richgalloway]

The goal is to exclude from the results those events that match the subsearch.

[IRHM73]

Hi @richgalloway, thank you for taking the time to reply to my post and for the simple explanation. A great help!

Kind regards

Chris