Working with the NOT command

jialiu907 — Tue, 09 May 2023 20:56:12 GMT

So I am trying to search through some results and I am trying to display the results that ExitStatus=0 which means it ran correctly and ExitStatus=anything else which is not 0, meaning it is an error. I am looking to have a pie chart which it shows either ExitStatus=0 or ExitStatus= NOT 1.

Re: Working with the NOT command

richgalloway — Tue, 09 May 2023 21:38:57 GMT

There are two ways to do a negative test in SPL - the NOT operator and the != operator. Each has slightly different syntax and behaves slightly differently.

| eval result=if(ExitStatus!=0, "Error", "Success")

The != operator looks at events that have an ExitStatus field that has a value. Nulls are ignored.

| eval result=if(NOT ExitStatus=0, "Error", "Success")

The NOT operator looks at all events, even those that do not have an ExitStatus field. Nulls are included. A null does not match the target value.

That said, I think you don't need either operator. Just have the pie chart show how many of each ExitStatus there is.

| chart count by ExitStatus

If you really want only 2 values displayed then you can normalize the values before charting them.

| eval ExitStatus=if(ExitStatus>0, 1, 0) | chart count by ExitStatus

topic Re: Working with the NOT command in Splunk Search

Working with the NOT command

Re: Working with the NOT command