topic Which is better NOT or != in Splunk Search

Which is better NOT or !=

skeetermurphy — Sat, 18 Sep 2010 02:57:31 GMT

Here are two searches that are the same.

NOT FIELD="value"

FIELD!="value"

Which should be used? Is this just a personal preference or are there any performance differences between the two.

There are lots of cases where the NOT prefixes a much more complex search, but I'm just wondering about this simple case.

Re: Which is better NOT or !=

gkanapathy — Sat, 18 Sep 2010 04:11:39 GMT

These two searches are not the same.

NOT field="value" will return events where field is undefined (or null). field!="value" will only return events where field exists (and does not have the value "value").

In the case where the value in question is "*", NOT field=* will return events where field is null/undefined. field!=* will never return any events.

Re: Which is better NOT or !=

gkanapathy — Sat, 18 Sep 2010 04:12:57 GMT

These searches are not the same. See below.