topic Splunk search using operator returning opposite results in Splunk Search

Splunk search using operator returning opposite results

tympaniplayer — Mon, 14 Nov 2011 21:28:47 GMT

When I use the windows app to search for a hardrive with less than a certain amount of space to set up alerts, I sometimes get results that are opposite of what I am expecting.

For example when I use this search:

source=WMI:FreeDiskSpace NOT localhost host="hostname" Name="C:" FreeMegabytes<"9216"

I will get matching events which have FreeMegabytes values greater than 9216

However when I use the greater than operator search returns 0 results. This seems to be an intermittent problem.

Re: Splunk search using operator returning opposite results

tgow — Mon, 14 Nov 2011 22:22:00 GMT

You might want to change your search to the following:

source="WMI:FreeDiskSpace" NOT host=localhost host="hostname" Name="C:" | where FreeMegabytes < 9216

Re: Splunk search using operator returning opposite results

tympaniplayer — Tue, 15 Nov 2011 15:17:22 GMT

Thank you so much, still learning about how to search in splunk!

Re: Splunk search using operator returning opposite results

araitz — Tue, 15 Nov 2011 15:48:49 GMT

By quoting the value on the right, Splunk will interpret it as a string. Remove the quotes and all will be well. I would not recommend | where, as this is a far more inefficient search.

In general, you want to be as specific as possible to the left of the first pipe. The one exception to this, where you have to use where, is when you are comparing two fields, e.g. if foo and bar are extracted or calculated fields:

...| where foo > bar