Working with the NOT command

[jialiu907]

So I am trying to search through some results and I am trying to display the results that ExitStatus=0 which means it ran correctly and ExitStatus=anything else which is not 0, meaning it is an error. I am looking to have a pie chart which it shows either ExitStatus=0 or ExitStatus= NOT 1. 

[richgalloway · Accepted solution]

There are two ways to do a negative test in SPL - the NOT operator and the != operator.  Each has slightly different syntax and behaves slightly differently.

| eval result=if(ExitStatus!=0, "Error", "Success")

The != operator looks at events that have an ExitStatus field that has a value.  Nulls are ignored.

| eval result=if(NOT ExitStatus=0, "Error", "Success")

The NOT operator looks at all events, even those that do not have an ExitStatus field.  Nulls are included.  A null does not match the target value.

That said, I think you don't need either operator.  Just have the pie chart show how many of each ExitStatus there is.

| chart count by ExitStatus

If you really want only 2 values displayed then you can normalize the values before charting them.

| eval ExitStatus=if(ExitStatus>0, 1, 0)
| chart count by ExitStatus