topic Re: how to filter by "does not equal" in Getting Data In

how to filter by "does not equal"

Techfrogger — Tue, 23 Oct 2012 14:57:24 GMT

I know how to filter for a specific event so, for example, I always run this:
source=wineventlog:* earliest_time=-24h "Type=Success"
But what I'd now like to do is the opposite: I'd like to eliminate all these "successes" so I can see all the rest. Since I don't know what the rest are, I can't filter by them. Can I do something like "type DOES NOT EQUAL Success"?

Re: how to filter by "does not equal"

sowings — Tue, 23 Oct 2012 15:00:30 GMT

It's as simple as "Type!=Success".

Re: how to filter by "does not equal"

Techfrogger — Mon, 28 Sep 2020 12:40:38 GMT

So why is that when I search on
source=wineventlog:* earliest_time=-24h
I get approximately 25,000 responses and when I search on
source=wineventlog:* earliest_time=-24h "Type=Success"
I get approximately 24,000
But when I then search on
source=wineventlog:* earliest_time=-24h "Type!=Success"
I get zero responses? I should get back approximately 1,000 responses. What am I doing wrong?

Re: how to filter by "does not equal"

sowings — Tue, 23 Oct 2012 16:20:47 GMT

It's possible that the only events with a 'Type' field defined are those where Type=Success. If that's true, then the third search (with !=) would have no field 'Type' against which to evaluate = or even !=.

Also consider absolute time frames, so that the time at which the search is executed isn't leading to different answers. Consider "yesterday" -> earliest=-1d@d latest=@d

Re: how to filter by "does not equal"

Ayn — Tue, 23 Oct 2012 16:35:43 GMT

your_search Type!=Success | the_rest_of_your_search

without the quotes, otherwise Splunk will literally be looking for the string "Type!=Success". Also you might want to do NOT Type=Success instead. The reason for that is that Type!=Success implies that the field "Type" exists, but is not equal to "Success". If the "Type" field doesn't exist at all, the filtering expression will not match.

Re: how to filter by "does not equal"

kristian_kolb — Tue, 23 Oct 2012 19:23:08 GMT

Don't be so humble. Converted it to an answer for you 🙂

Re: how to filter by "does not equal"

wangweibee — Wed, 10 Dec 2014 03:53:14 GMT

"not equal " is just "!="

Re: how to filter by "does not equal"

Keysofsandiego — Thu, 05 Mar 2015 21:45:00 GMT

another example

foo search ... source=WinEventLog:Security | yadda yadda yadda

or the opposite

foo search ... source!=WinEventLog:Security | yadda yadda yadda

Its not easy to understand what people are saying when you are a newb as I am.

Re: how to filter by "does not equal"

Marco — Wed, 14 Oct 2020 15:18:32 GMT

@kristian_kolb

LOL this comment made my day 8 years later

-Marco