topic Re: Search '!=' does not work after upgrading to Splunk 8 in Splunk Search

Search '!=' does not work after upgrading to Splunk 8

girtsgr — Fri, 08 Nov 2019 07:05:24 GMT

Anybody else having issues with search operator '!=' after upgrading to Splunk Enterprise 8?

My search is index=myindex | search src_ip!=10.0.0.0/8 and after the upgrade Splunk started to return all the local addresses in the search results. Any ideas what to do?

Re: Search '!=' does not work after upgrading to Splunk 8

manjunathmeti — Fri, 08 Nov 2019 07:40:37 GMT

Try index=myindex src_ip!="10.0.0.0/8" OR index=myindex NOT src_ip="10.0.0.0/8".

Re: Search '!=' does not work after upgrading to Splunk 8

girtsgr — Fri, 08 Nov 2019 07:45:49 GMT

Tried it already, no luck.

Re: Search '!=' does not work after upgrading to Splunk 8

martin_mueller — Fri, 08 Nov 2019 08:24:25 GMT

Looks like a bug to me, I've filed a case ¯\(ツ)/¯

Re: Search '!=' does not work after upgrading to Splunk 8

martin_mueller — Mon, 11 Nov 2019 20:34:46 GMT

Repro'd by support, bug SPL-179357.

Re: Search '!=' does not work after upgrading to Splunk 8

girtsgr — Tue, 12 Nov 2019 06:36:41 GMT

Is it worth to file another report? Will that help to escalate the priority of this bug?

Re: Search '!=' does not work after upgrading to Splunk 8

martin_mueller — Tue, 12 Nov 2019 07:17:41 GMT

Can't hurt to tell support that you're affected too. At the very least they'll then tell you when a fix is available.

Re: Search '!=' does not work after upgrading to Splunk 8

girtsgr — Tue, 12 Nov 2019 07:33:59 GMT

Thanks, done.

Re: Search '!=' does not work after upgrading to Splunk 8

girtsgr — Tue, 12 Nov 2019 11:40:49 GMT

FYI: support suggested a workaround:

There is a workaround, try this:
use a "| where" command instead, example:
index=_internal
| where NOT cidrmatch("127.0.0.0/8", clientip)
| stats count BY clientip

Re: Search '!=' does not work after upgrading to Splunk 8

mhoogcarspel_sp — Tue, 12 Nov 2019 15:07:25 GMT

Just to be clear, it's the combination of:
Splunk 8.0.0
search
negation (!=, NOT)
in combination with CIDR based filtering (10.0.0.0/8)

where command with cidrmatch isn't affected
negation of non-CIDR values isn't affected

Re: Search '!=' does not work after upgrading to Splunk 8

garias_splunk — Tue, 12 Nov 2019 16:00:35 GMT

There is a workaround, try this:
use a "| where" command instead, example:
index=_internal
| where NOT cidrmatch("127.0.0.0/8", clientip)
| stats count BY clientip

Re: Search '!=' does not work after upgrading to Splunk 8

girtsgr — Wed, 13 Nov 2019 06:40:29 GMT

Fails without search command as well, eg, index=myindex src_ip!=10.0.0.0/8

But yes:

where command with cidrmatch isn't affected
negation of non-CIDR values isn't affected
true

Re: Search '!=' does not work after upgrading to Splunk 8

girtsgr — Wed, 13 Nov 2019 06:42:33 GMT

Yeah, already got the support email and implemented it in some cases, and also posted here.

Re: Search '!=' does not work after upgrading to Splunk 8

mhoogcarspel_sp — Wed, 13 Nov 2019 15:11:56 GMT

"index=myindex src_ip!=10.0.0.0/8" is also the search command, any search string without a command at the beginning is actually "| search ... " 🙂

Re: Search '!=' does not work after upgrading to Splunk 8

niketn — Wed, 13 Nov 2019 15:35:19 GMT

Adding a where to second pipe would mean query will become expensive. You will be pulling all IPs from index then filtering out one is a very bad search to execute. This can be a workaround only if your Splunk Infrastructure can support and only if dashboard somehow still performs.

Re: Search '!=' does not work after upgrading to Splunk 8

martin_mueller — Wed, 13 Nov 2019 18:16:49 GMT

Not really, no. The original NOT field=value for search-time fields is slow already, not making it to lispy. Moving it to a where won't change scanCount.

Re: Search '!=' does not work after upgrading to Splunk 8

niketn — Wed, 13 Nov 2019 18:56:00 GMT

I did NOT see that. Thanks for correction 🙂

Re: Search '!=' does not work after upgrading to Splunk 8

mbrunetto — Wed, 30 Sep 2020 03:31:58 GMT

Worked a similar issue with support, but couldn't use the "where" option due to the way my search was formed. You can also make a change to limits.conf to use the old behavior. Documenting here in case anyone else finds this article looking for a similar solution.

Workaround:
limits.conf: [search] use_search_evaluator_v2=false

Tracked as Splunk Issues: SPL-179357, SPL-179700
Reference:
https://docs.splunk.com/Documentation/Splunk/8.0.0/ReleaseNotes/Knownissues