Splunk Search

Difference between NOT and != Operators

jli001
Explorer

index="aws-cloudtrail" errorCode!=success returns the results I expect, i.e., events that have error codes other than "success".

index="aws-cloudtrail" NOT errorCode=success returns no results at all.

I understand that the != operator implies that field exists in my data, but that does not explain the behavior I am seeing.

Thanks!

Tags (2)
0 Karma
1 Solution

ChrisG
Splunk Employee
Splunk Employee

Try with quotes around "errorCode=success"

View solution in original post

ChrisG
Splunk Employee
Splunk Employee

Try with quotes around "errorCode=success"

jli001
Explorer

Ha! That works.

The string "errorCode=success" does not actually exist in the raw data (which is in JSON). errorCode=success is how Splunk's "syntax highlighting" presents the data. I wonder if Splunk is looking for the string errorCode=success literally when I don't have quotes around it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...