Splunk Search

Working with the NOT command

jialiu907
Path Finder

So I am trying to search through some results and I am trying to display the results that ExitStatus=0 which means it ran correctly and ExitStatus=anything else which is not 0, meaning it is an error. I am looking to have a pie chart which it shows either ExitStatus=0 or ExitStatus= NOT 1. 

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There are two ways to do a negative test in SPL - the NOT operator and the != operator.  Each has slightly different syntax and behaves slightly differently.

| eval result=if(ExitStatus!=0, "Error", "Success")

The != operator looks at events that have an ExitStatus field that has a value.  Nulls are ignored.

| eval result=if(NOT ExitStatus=0, "Error", "Success")

The NOT operator looks at all events, even those that do not have an ExitStatus field.  Nulls are included.  A null does not match the target value.

That said, I think you don't need either operator.  Just have the pie chart show how many of each ExitStatus there is.

| chart count by ExitStatus

If you really want only 2 values displayed then you can normalize the values before charting them.

| eval ExitStatus=if(ExitStatus>0, 1, 0)
| chart count by ExitStatus
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

There are two ways to do a negative test in SPL - the NOT operator and the != operator.  Each has slightly different syntax and behaves slightly differently.

| eval result=if(ExitStatus!=0, "Error", "Success")

The != operator looks at events that have an ExitStatus field that has a value.  Nulls are ignored.

| eval result=if(NOT ExitStatus=0, "Error", "Success")

The NOT operator looks at all events, even those that do not have an ExitStatus field.  Nulls are included.  A null does not match the target value.

That said, I think you don't need either operator.  Just have the pie chart show how many of each ExitStatus there is.

| chart count by ExitStatus

If you really want only 2 values displayed then you can normalize the values before charting them.

| eval ExitStatus=if(ExitStatus>0, 1, 0)
| chart count by ExitStatus
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Almost Too Eventful Assurance: Part 1

Modern IT and Network teams still struggle with too many alerts and isolating issues before they are notified. ...

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...