Splunk Search

Use of "NOT" vs "!="

rtadams89
Contributor

I'm working on a search which should return all events, except those where the "User_Name" or the "Account_Name" fields end with a "$".

If I use this

(NOT (User_Name="*$" OR Account_Name="*$"))

I get the reuslts I expect. However if I use

User_Name!="*$" Account_Name!="*$"

I don't get any results.

In my mind, those two statements should produce the same results. What is it I'm not seeing?

1 Solution

Ayn
Legend

The difference is that with != it's implied that the field exists, but does not have the value specified. So if the field is not found at all in the event, the search will not match.

NOT field= on the other hand will check if the field has the specified value, and if it doesn't for whatever reason, it will match.

View solution in original post

Ayn
Legend

The difference is that with != it's implied that the field exists, but does not have the value specified. So if the field is not found at all in the event, the search will not match.

NOT field= on the other hand will check if the field has the specified value, and if it doesn't for whatever reason, it will match.

debabratp
New Member

It helps a lot.

0 Karma

Ayn
Legend

Yeah, because that would say 'User_Name exists and it doesn't match "*$" OR Account_Name exists and it doesn't match "*$"'.

rtadams89
Contributor

Ahh. Well that helps. So jsut for further clarification, I could solve the problem and still use != if I did:

User_Name!="*$" OR Account_Name!="*$"

Assuming I know for sure that all events will have one (and only one) of those fields.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...