Splunk search using operator returning opposite results

[tympaniplayer]

When I use the windows app to search for a hardrive with less than a certain amount of space to set up alerts, I sometimes get results that are opposite of what I am expecting.

For example when I use this search:

source=WMI:FreeDiskSpace NOT localhost host="hostname" Name="C:" FreeMegabytes<"9216"

I will get matching events which have FreeMegabytes values greater than 9216

However when I use the greater than operator search returns 0 results. This seems to be an intermittent problem.

[araitz · Accepted solution]

By quoting the value on the right, Splunk will interpret it as a string. Remove the quotes and all will be well. I would not recommend | where, as this is a far more inefficient search.

In general, you want to be as specific as possible to the left of the first pipe. The one exception to this, where you have to use where, is when you are comparing two fields, e.g. if foo and bar are extracted or calculated fields:

...| where foo > bar

[tgow]

You might want to change your search to the following:

source="WMI:FreeDiskSpace" NOT host=localhost host="hostname" Name="C:" | where FreeMegabytes < 9216 

[tympaniplayer]

Thank you so much, still learning about how to search in splunk!