What is the difference between true and not false?

[michaelsplunk1]

Is querying by myField=true or myField != false the same thing? Is saying myField=true better or more efficient?

Thank you!

[bowesmana]

If you are asking this for a search command string, then the two statements

myField = true
myField != false

is like saying

myField = "true"
myField != "false"

because Splunk does not have boolean field types, only string and number so clearly the above would not be the same.

In general, Splunk does not have the concept of a field with boolean values, as you can see from this search example

| makeresults
| eval x=if(true(), true(), false())