What is the difference between true and not false?

michaelsplunk1 — Wed, 26 May 2021 20:38:24 GMT

Is querying by myField=true or myField != false the same thing? Is saying myField=true better or more efficient?

Thank you!

Re: What is the difference between true and not false?

bowesmana — Wed, 26 May 2021 22:31:12 GMT

If you are asking this for a search command string, then the two statements

myField = true myField != false

is like saying

myField = "true" myField != "false"

because Splunk does not have boolean field types, only string and number so clearly the above would not be the same.

In general, Splunk does not have the concept of a field with boolean values, as you can see from this search example

| makeresults | eval x=if(true(), true(), false())