https://community.splunk.com/t5/Splunk-Search/How-to-get-subsearch-to-return-a-result-which-is-NOT-EQUAL-to/m-p/205722#M59817 <P>The opposite of <CODE>(id=10000) OR (id=10001) OR (id=10002)</CODE> is <CODE>(id!=10000 AND id!=10001 AND id!=10002)</CODE> or simply <CODE>NOT ((id=10000) OR (id=10001) OR (id=10002))</CODE>.</P> <P>With subsearches fetching this filter condition it can be used either of following ways:-</P> <PRE><CODE> search query | search NOT [subsearch query | return field] | .... search query NOT [subsearch query | return field] .... search query | where NOT [subsearch query | return field] </CODE></PRE> Fri, 23 Dec 2016 15:56:03 GMT somesoni2 2016-12-23T15:56:03Z https://community.splunk.com/t5/Splunk-Search/How-to-get-subsearch-to-return-a-result-which-is-NOT-EQUAL-to/m-p/205720#M59815 <P>Hi there, currently I am comparing data from two data sources and have achieved some great comparisons in which my subsearch returned field value equaling the matching value eg:</P> <PRE><CODE>(id=10000) or (id=10001) or (id=10002) </CODE></PRE> <P>etc..</P> <P>However I am wondering if it is possible to return something like:</P> <PRE><CODE>(id!=10000) or (id!=10001) or (id!=10002) </CODE></PRE> <P>etc..</P> <P>OR alternatively - can I simply do something like this in my search query:</P> <PRE><CODE>search query | NOT [subsearch query | return field] </CODE></PRE> <P>Or perhaps with brackets?</P> <PRE><CODE>search query | (NOT [subsearch query | return field]) </CODE></PRE> <P>Please help!</P> Fri, 23 Dec 2016 00:55:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-subsearch-to-return-a-result-which-is-NOT-EQUAL-to/m-p/205720#M59815 alexandermunce 2016-12-23T00:55:33Z https://community.splunk.com/t5/Splunk-Search/How-to-get-subsearch-to-return-a-result-which-is-NOT-EQUAL-to/m-p/205721#M59816 <P>I would follow the kiss principle and use - <CODE>search query NOT id=10000 NOT id=10001 NOT id=10002</CODE>.</P> <P>BTW - please use <STRONG>OR</STRONG> (versus or) such as - <CODE>(id=10000) OR (id=10001) OR (id=10002)</CODE></P> Fri, 23 Dec 2016 03:57:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-subsearch-to-return-a-result-which-is-NOT-EQUAL-to/m-p/205721#M59816 ddrillic 2016-12-23T03:57:43Z https://community.splunk.com/t5/Splunk-Search/How-to-get-subsearch-to-return-a-result-which-is-NOT-EQUAL-to/m-p/205722#M59817 <P>The opposite of <CODE>(id=10000) OR (id=10001) OR (id=10002)</CODE> is <CODE>(id!=10000 AND id!=10001 AND id!=10002)</CODE> or simply <CODE>NOT ((id=10000) OR (id=10001) OR (id=10002))</CODE>.</P> <P>With subsearches fetching this filter condition it can be used either of following ways:-</P> <PRE><CODE> search query | search NOT [subsearch query | return field] | .... search query NOT [subsearch query | return field] .... search query | where NOT [subsearch query | return field] </CODE></PRE> Fri, 23 Dec 2016 15:56:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-subsearch-to-return-a-result-which-is-NOT-EQUAL-to/m-p/205722#M59817 somesoni2 2016-12-23T15:56:03Z https://community.splunk.com/t5/Splunk-Search/How-to-get-subsearch-to-return-a-result-which-is-NOT-EQUAL-to/m-p/205723#M59818 <P>The output you have provided is simply the output of ,y above subquery? Not what I was after sorry</P> Sun, 25 Dec 2016 13:38:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-subsearch-to-return-a-result-which-is-NOT-EQUAL-to/m-p/205723#M59818 alexandermunce 2016-12-25T13:38:16Z https://community.splunk.com/t5/Splunk-Search/How-to-get-subsearch-to-return-a-result-which-is-NOT-EQUAL-to/m-p/205724#M59819 <P>Exactly what I was after, thank you good sir!</P> Sun, 25 Dec 2016 13:38:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-subsearch-to-return-a-result-which-is-NOT-EQUAL-to/m-p/205724#M59819 alexandermunce 2016-12-25T13:38:44Z https://community.splunk.com/t5/Splunk-Search/How-to-get-subsearch-to-return-a-result-which-is-NOT-EQUAL-to/m-p/205725#M59820 <P>@somesoni2</P> <P>Based on your response above - would I need to place brackets around the subsearch similar to below;</P> <PRE><CODE>search query NOT ([subsearch query | return field]) </CODE></PRE> Wed, 28 Dec 2016 01:49:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-subsearch-to-return-a-result-which-is-NOT-EQUAL-to/m-p/205725#M59820 alexandermunce 2016-12-28T01:49:30Z https://community.splunk.com/t5/Splunk-Search/How-to-get-subsearch-to-return-a-result-which-is-NOT-EQUAL-to/m-p/205726#M59821 <P>@somesoni2</P> <P>I am concerned that my search will end up as:</P> <PRE><CODE>search query NOT (id=10000) OR (id=10001) OR (id=10002) </CODE></PRE> <P>This above syntax is not valid right?</P> Wed, 28 Dec 2016 01:51:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-subsearch-to-return-a-result-which-is-NOT-EQUAL-to/m-p/205726#M59821 alexandermunce 2016-12-28T01:51:18Z https://community.splunk.com/t5/Splunk-Search/How-to-get-subsearch-to-return-a-result-which-is-NOT-EQUAL-to/m-p/205727#M59822 <P>Above one is not valid/correct for your requirements. The subsearch will automatically put proper brackets when resolved. You can validate that by checking the job Inspector, look for attribute normalized search.</P> Wed, 28 Dec 2016 02:01:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-subsearch-to-return-a-result-which-is-NOT-EQUAL-to/m-p/205727#M59822 somesoni2 2016-12-28T02:01:50Z https://community.splunk.com/t5/Splunk-Search/How-to-get-subsearch-to-return-a-result-which-is-NOT-EQUAL-to/m-p/571977#M199313 <P>Please note that id!=1 and NOT id=1 are NOT equal.</P><P>If you have the following events</P><P>id=1 someotherfield=a<BR />someotherfield=a<BR />id=1 someotherfield=a<BR />id=2 someotherfield=b</P><P>searching for someotherfield=a NOT id=1 leads to</P><P>someotherfield=a<BR />id=2 someotherfield=b</P><P>whereas searching for someotherfield=a id!=1 leads to</P><P>id=2 someotherfield=b</P><P>as id!=1 only returns events that contain field id, but not value 1, whereas NOT id=1 removes events with id=1 from the previous event set.</P> Fri, 22 Oct 2021 09:49:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-subsearch-to-return-a-result-which-is-NOT-EQUAL-to/m-p/571977#M199313 dvb 2021-10-22T09:49:47Z