query not returning resutls

[sarit_s]

Hello
I have  a query that contains some conditions and one of them is "AND NOT eventtype=..."
the eventtype is not configured in our system so it is not supposed to return results.. 

my question is - if the condition is "AND NOT" but the eventtype not configured the query should return results or not ?

thanks

[scelikok]

Hi @sarit_s,

Yes, query will work and produce results. You will just see a yellow warning indicator on the left of Job that says particular eventtype is not exist or disabled.

[sarit_s]

If im running some query AND NOT eventtype=... there are no results but if i will remove the eventtype=.. part it will return results

[scelikok]

Hi @sarit_s,

Because of NOT condition, missing eventtype field is ok. That is why search will return results. 

[sarit_s]

Hey

thanks for your reply. Im not sure I understood 

i have a query that contains eventtype=...
but this specific  eventtype is not configured in our system (all of them are configured in eventtype.conf file). So my question was if i have query that contains eventtype that is not configured but im querying it with NOT

the query should work or not ?