Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Can you tell me the difference between two boolean...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I am currently figuring out what is wrong with my boolean expression.
Currently, I'm making a whitelist of application on sysmon app.
The thing is, I got a different result when I used "(Image!=[process1] AND Image!=[Process2])" and "NOT (Image=[process1] OR Image=[process2])"
I would appreciate if you tell me the difference between these two boolean expressions.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@y2kbcm,
If you search with the != expression, every event that has a value in the field, where that value does not match the value you specify, is returned. Events that do not have a value in the field are not included in the results.
If you search with the NOT operator, every event is returned except the events that contain the value you specify. This includes events that do not have a value in the field.
It's explained in Difference between NOT and != with examples.
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@y2kbcm,
If you search with the != expression, every event that has a value in the field, where that value does not match the value you specify, is returned. Events that do not have a value in the field are not included in the results.
If you search with the NOT operator, every event is returned except the events that contain the value you specify. This includes events that do not have a value in the field.
It's explained in Difference between NOT and != with examples.
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you very much for your comment.
I went over the search manual but it didn't mean anything back then. Now it makes sense!
Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps
What’s New in Splunk Observability – September 2025
Fun with Regular Expression - multiples of nine
