Archive

Difference between the NOT and != operators?

Motivator

What is the difference between the NOT operator and the != operator?

I have always used NOT up to this point, but am seeing some very strange behavior associated with it today* and != seems to function as I intend.

NOT seems to be adding seemingly unrelated terms to litsearch in the search inspector's "remote search" which cause the search to fail

Tags (2)
1 Solution

Legend

The difference is that with != it's implied that the field exists, but does not have the value specified. So if the field is not found at all in the event, the search will not match.

NOT field= on the other hand will check if the field has the specified value, and if it doesn't for whatever reason, it will match.

(from http://splunk-base.splunk.com/answers/43228/use-of-not-vs )

View solution in original post

Legend

The difference is that with != it's implied that the field exists, but does not have the value specified. So if the field is not found at all in the event, the search will not match.

NOT field= on the other hand will check if the field has the specified value, and if it doesn't for whatever reason, it will match.

(from http://splunk-base.splunk.com/answers/43228/use-of-not-vs )

View solution in original post

Champion

From my point of view, NOT is like a logical operator rather than the exact "Not equal to operator" which should be considered as an arithmetic operator. Internally it should work like that as other languages, but sometimes it's output makes us think them the same.

0 Karma

Motivator

Well, that mentions they're different, I want to know how they're different, why one (NOT) added some unnecessary terms to litsearch that broke one of my searches when the other (!=) did not.

0 Karma

Path Finder

Possibly what you're looking for

Difference between NOT and !=

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!