- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Use of "NOT" vs "!="
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm working on a search which should return all events, except those where the "User_Name" or the "Account_Name" fields end with a "$".
If I use this
(NOT (User_Name="*$" OR Account_Name="*$"))
I get the reuslts I expect. However if I use
User_Name!="*$" Account_Name!="*$"
I don't get any results.
In my mind, those two statements should produce the same results. What is it I'm not seeing?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The difference is that with != it's implied that the field exists, but does not have the value specified. So if the field is not found at all in the event, the search will not match.
NOT field= on the other hand will check if the field has the specified value, and if it doesn't for whatever reason, it will match.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The difference is that with != it's implied that the field exists, but does not have the value specified. So if the field is not found at all in the event, the search will not match.
NOT field= on the other hand will check if the field has the specified value, and if it doesn't for whatever reason, it will match.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It helps a lot.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yeah, because that would say 'User_Name exists and it doesn't match "*$" OR Account_Name exists and it doesn't match "*$"'.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ahh. Well that helps. So jsut for further clarification, I could solve the problem and still use != if I did:
User_Name!="*$" OR Account_Name!="*$"
Assuming I know for sure that all events will have one (and only one) of those fields.
Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...
Splunk APM: New Product Features + Community Office Hours Recap!
Index This | Forward, I’m heavy; backward, I’m not. What am I?
