Splunk Search

"NOT TERM" removes results

landen99
Motivator

When using NOT TERM, please keep in mind the following bug (see the answer for the workaround):

index=myindex NOT TERM(b=c)

will yield zero results if all the events contain “a_b=c” like this:

foo a_b=c b=d bar

The problem appears to exist only for normal searches using NOT on TERM where “b=c” exists in other places like “a_b=c”. It does not appear when using tstats. It seems to be a post-search filter.

Tags (1)
0 Karma
1 Solution

landen99
Motivator

The work-around appears to be to explicitly include “TERM(a_b=c)” like this:
index=myindex TERM(a_b=c) NOT TERM(b=c)

View solution in original post

0 Karma

mhoogcarspel_sp
Splunk Employee
Splunk Employee

That's not a bug I think, it's just "b=c" is not a term in the lexicon

fake results:

| makeresults 
| eval _raw="foo a_b=c b=d bar" 
| collect

can find it:

index=summary NOT TERM(b=c)

can't find it:

index=summary NOT TERM(*b=c)

validate:

| walklex index=summary 
| table * 
| search term="*b=c*"

tested on 8.0.1

("_" is a minor segmenter)
https://docs.splunk.com/Documentation/Splunk/8.0.0/Admin/Segmentersconf

https://docs.splunk.com/Documentation/Splunk/8.0.0/Search/UseCASEandTERMtomatchphrases

TERM: Match whatever is inside the
parentheses as a single term in the
index, even if it contains characters
that are usually recognized as minor
segmenters, such as periods or
underscores.
...

The TERM directive is useful when you
are searching for a term:

That contains minor breakers
Is bound by major breakers, such as spaces or commas Does not contain
major breakers

and your term isn't bound by major breakers, but a major (the space) and a minor one (the "_")

0 Karma

woodcock
Esteemed Legend
0 Karma

landen99
Motivator

The work-around appears to be to explicitly include “TERM(a_b=c)” like this:
index=myindex TERM(a_b=c) NOT TERM(b=c)

0 Karma

mhoogcarspel_sp
Splunk Employee
Splunk Employee

Don't think this is accurate, have a look at my answer below

0 Karma

landen99
Motivator

It is accurate. Martin Mueller has verified it too.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...