Hello
I have a query that contains some conditions and one of them is "AND NOT eventtype=..."
the eventtype is not configured in our system so it is not supposed to return results..
my question is - if the condition is "AND NOT" but the eventtype not configured the query should return results or not ?
thanks
Hi @sarit_s,
Yes, query will work and produce results. You will just see a yellow warning indicator on the left of Job that says particular eventtype is not exist or disabled.
If im running some query AND NOT eventtype=... there are no results but if i will remove the eventtype=.. part it will return results
Hi @sarit_s,
Because of NOT condition, missing eventtype field is ok. That is why search will return results.
Hey
thanks for your reply. Im not sure I understood
i have a query that contains eventtype=...
but this specific eventtype is not configured in our system (all of them are configured in eventtype.conf file). So my question was if i have query that contains eventtype that is not configured but im querying it with NOT
the query should work or not ?