Can't we use NOT in searchmatch function

[sarahnazzar]

Hi Splunkers!

I've a doubt regarding searchmatch function, when I tried excluding some string using NOT boolean inside a searchmatch..it is not working fine although AND/OR Boolean is working fine..

Can't we use NOT while using searchmatch in query?

Below is my sample query:

index=xxx source=yyy "Issue-1111" OR "Issue-1122" OR "Failure-1212" OR "Failure-1111" OR "Failure-"
|eval Result=case(searchmatch("Issue-1111"), "Desc 1",
searchmatch("Issue-1122"), "Desc 2",
searchmatch("Failure-1212"), "Desc 3",
searchmatch("Failure-1111"), "Desc 4",
(searchmatch("Failure-") NOT searchmatch("Failure-1111") NOT searchmatch("Failure-1212") , "All Failures Excluding Desc3&4"))
|stats count by Result

Thanks in Advance!

[richgalloway · Accepted solution]

NOT is allowed in that use case, but must be accompanied by AND or OR. For example,

|eval Result=case(searchmatch("Issue-1111"), "Desc 1",
searchmatch("Issue-1122"), "Desc 2",
searchmatch("Failure-1212"), "Desc 3",
searchmatch("Failure-1111"), "Desc 4",
(searchmatch("Failure-") AND NOT searchmatch("Failure-1111") AND NOT searchmatch("Failure-1212") , "All Failures Excluding Desc3&4"))