Archive

"NOT TERM" removes results

landen99
Motivator

When using NOT TERM, please keep in mind the following bug (see the answer for the workaround):

index=myindex NOT TERM(b=c)

will yield zero results if all the events contain “a_b=c” like this:

foo a_b=c b=d bar

The problem appears to exist only for normal searches using NOT on TERM where “b=c” exists in other places like “a_b=c”. It does not appear when using tstats. It seems to be a post-search filter.

Tags (1)
0 Karma
1 Solution

landen99
Motivator

The work-around appears to be to explicitly include “TERM(a_b=c)” like this:
index=myindex TERM(a_b=c) NOT TERM(b=c)

View solution in original post

0 Karma

mhoogcarspel_sp
Splunk Employee
Splunk Employee

That's not a bug I think, it's just "b=c" is not a term in the lexicon

fake results:

| makeresults 
| eval _raw="foo a_b=c b=d bar" 
| collect

can find it:

index=summary NOT TERM(b=c)

can't find it:

index=summary NOT TERM(*b=c)

validate:

| walklex index=summary 
| table * 
| search term="*b=c*"

tested on 8.0.1

("_" is a minor segmenter)
https://docs.splunk.com/Documentation/Splunk/8.0.0/Admin/Segmentersconf

https://docs.splunk.com/Documentation/Splunk/8.0.0/Search/UseCASEandTERMtomatchphrases

TERM: Match whatever is inside the
parentheses as a single term in the
index, even if it contains characters
that are usually recognized as minor
segmenters, such as periods or
underscores.
...

The TERM directive is useful when you
are searching for a term:

That contains minor breakers
Is bound by major breakers, such as spaces or commas Does not contain
major breakers

and your term isn't bound by major breakers, but a major (the space) and a minor one (the "_")

0 Karma

woodcock
Esteemed Legend
0 Karma

landen99
Motivator

The work-around appears to be to explicitly include “TERM(a_b=c)” like this:
index=myindex TERM(a_b=c) NOT TERM(b=c)

View solution in original post

0 Karma

mhoogcarspel_sp
Splunk Employee
Splunk Employee

Don't think this is accurate, have a look at my answer below

0 Karma

landen99
Motivator

It is accurate. Martin Mueller has verified it too.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!