topic Re: query not returning resutls in Splunk Dev

query not returning resutls

sarit_s — Mon, 01 Mar 2021 09:06:48 GMT

Hello
I have a query that contains some conditions and one of them is "AND NOT eventtype=..."
the eventtype is not configured in our system so it is not supposed to return results..

my question is - if the condition is "AND NOT" but the eventtype not configured the query should return results or not ?

thanks

Re: query not returning resutls

scelikok — Tue, 02 Mar 2021 16:46:19 GMT

Hi @sarit_s,

Because of NOT condition, missing eventtype field is ok. That is why search will return results.

Re: query not returning resutls

sarit_s — Tue, 02 Mar 2021 16:51:02 GMT

Hey

thanks for your reply. Im not sure I understood

i have a query that contains eventtype=...
but this specific eventtype is not configured in our system (all of them are configured in eventtype.conf file). So my question was if i have query that contains eventtype that is not configured but im querying it with NOT

the query should work or not ?

Re: query not returning resutls

scelikok — Wed, 03 Mar 2021 20:10:32 GMT

Hi @sarit_s,

Yes, query will work and produce results. You will just see a yellow warning indicator on the left of Job that says particular eventtype is not exist or disabled.

Re: query not returning resutls

sarit_s — Thu, 04 Mar 2021 05:03:45 GMT

If im running some query AND NOT eventtype=... there are no results but if i will remove the eventtype=.. part it will return results