Archive

Difference between NOT and != Operators

Explorer

index="aws-cloudtrail" errorCode!=success returns the results I expect, i.e., events that have error codes other than "success".

index="aws-cloudtrail" NOT errorCode=success returns no results at all.

I understand that the != operator implies that field exists in my data, but that does not explain the behavior I am seeing.

Thanks!

Tags (2)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

Try with quotes around "errorCode=success"

View solution in original post

Splunk Employee
Splunk Employee

Try with quotes around "errorCode=success"

View solution in original post

Explorer

Ha! That works.

The string "errorCode=success" does not actually exist in the raw data (which is in JSON). errorCode=success is how Splunk's "syntax highlighting" presents the data. I wonder if Splunk is looking for the string errorCode=success literally when I don't have quotes around it.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!