Hi, I wonder whether someone could help me please.
I've been presented with the following search, and although as a beginner I understand most of it, I'm having difficulty in working out the intention of the NOT search element.
auditSource=ts detail.cofcEventType=* NOT [search auditSource=ts auditType=RenewalCompleted]| stats count by auditType
I've trawled through the Splunk documentation many times and a host of posts, but I'm still none the wiser.
I just wondered whether someone may be able to advise me on what the author of the search is trying to achieve and the reason behind using the 'NOT search' operators.
Many thanks and kind regards
Chris
This is how you should read the query
auditSource=ts detail.cofcEventType=* NOT [search auditSource=ts auditType=RenewalCompleted]| stats count by auditType
|-----------base search-------------| |---------Filter search/subsearch-------------------| |--- transformation/aggregation--|
The base search will select certain events, the filter will remove certain events from the results of base search, transformation/aggregation will be applied on the filtered events.
Unrelated, this is how you can rewrite the search for more readability
auditSource=ts detail.cofcEventType=* NOT auditType=RenewalCompleted| stats count by auditType
This is how you should read the query
auditSource=ts detail.cofcEventType=* NOT [search auditSource=ts auditType=RenewalCompleted]| stats count by auditType
|-----------base search-------------| |---------Filter search/subsearch-------------------| |--- transformation/aggregation--|
The base search will select certain events, the filter will remove certain events from the results of base search, transformation/aggregation will be applied on the filtered events.
Unrelated, this is how you can rewrite the search for more readability
auditSource=ts detail.cofcEventType=* NOT auditType=RenewalCompleted| stats count by auditType
Hi @somesoni2, thank you very much for taking the time to reply to my post and for the clear explanation.
Once again many thanks and kind regards
Chris
The NOT statement in front of the subsearch will result in the main search returning events that do not contain the result of the subsearch. It is very litteral.
Consider the following example:
index=food foodtype=icecream topping=sprinkles
... will result in all events containing icecream with sprinkles.
index=food foodtype=icecream NOT topping=sprinkles
... will result in all events containing icecreams but not the ones that have sprinkle as topping.
Hi @ohlafi, I really appreciate you taking the time to reply to my post with a good explanation. Very much appreciated.
Kind Regards
Chris
The goal is to exclude from the results those events that match the subsearch.
Hi @richgalloway, thank you for taking the time to reply to my post and for the simple explanation. A great help!
Kind regards
Chris