Why does "search host!=ComputerName" return all results?

[DamageSplunk]

I'm looking for Splunk Universal Forwarders that have a different name registered other than the actual host name. This usually happens when a server is renamed. When I execute the search below, I get back the same # of events as if I don't do the comparison. An export of the data to Excel with a simple comparison formula shows that out of the 2619 events returned there are actually 15 servers with old host names.

Why doesn't the search return 15 events?

index=machine sourcetype=WinHostMon source=os host=* ComputerName=* | search host!=ComputerName | table host ComputerName

[acharlieh · Accepted solution]

Just like how in your base search sourcetype=WinHostMon is looking for the sourcetype field to match the string WinHostMon and not a field named WinHostMon, so your search is doing the same looking any host that is not the string ComputerName

What you want instead is the where command which allows for more precision, and even lets you use useful functions in comparisons!

index=machine sourcetype=WinHostMon source=os host= ComputerName= | where host!=ComputerName | table host ComputerName