Hello Everyone, I have two queries to exclude events one using NOT and other one using IN, both the queries returning same results but the query using NOT command takes less time.
My question is it should be other way around, why NOT is take less time to execute.
Time taken by Splunk using IN query
Time taken by Splunk using NOT query
index = "some_index" sourcetype="some_sourec_type" app_code=XXXX a_status IN (0,1,40) AND b_status IN (2,1,10,20)
index = "some_index" sourcetype="some_sourec_type" app_code=XXXX NOT a_status IN (0, -1, -2, -5) NOT b_status IN (-1, -6, -5, null)
zero in both conditions, means that the two searches have different results,
probably the zero condition matches many events and so the NOT conditions excludes more events, so in the result you have much less events so the results visualization is faster.
Try to use zero only in one of the searches.
in general a NOT condition is always slower than an IN condition, so it's very strange your behavior.
Only two questions: