Splunk Search

Working with the NOT command

jialiu907
Path Finder

So I am trying to search through some results and I am trying to display the results that ExitStatus=0 which means it ran correctly and ExitStatus=anything else which is not 0, meaning it is an error. I am looking to have a pie chart which it shows either ExitStatus=0 or ExitStatus= NOT 1. 

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There are two ways to do a negative test in SPL - the NOT operator and the != operator.  Each has slightly different syntax and behaves slightly differently.

| eval result=if(ExitStatus!=0, "Error", "Success")

The != operator looks at events that have an ExitStatus field that has a value.  Nulls are ignored.

| eval result=if(NOT ExitStatus=0, "Error", "Success")

The NOT operator looks at all events, even those that do not have an ExitStatus field.  Nulls are included.  A null does not match the target value.

That said, I think you don't need either operator.  Just have the pie chart show how many of each ExitStatus there is.

| chart count by ExitStatus

If you really want only 2 values displayed then you can normalize the values before charting them.

| eval ExitStatus=if(ExitStatus>0, 1, 0)
| chart count by ExitStatus
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

There are two ways to do a negative test in SPL - the NOT operator and the != operator.  Each has slightly different syntax and behaves slightly differently.

| eval result=if(ExitStatus!=0, "Error", "Success")

The != operator looks at events that have an ExitStatus field that has a value.  Nulls are ignored.

| eval result=if(NOT ExitStatus=0, "Error", "Success")

The NOT operator looks at all events, even those that do not have an ExitStatus field.  Nulls are included.  A null does not match the target value.

That said, I think you don't need either operator.  Just have the pie chart show how many of each ExitStatus there is.

| chart count by ExitStatus

If you really want only 2 values displayed then you can normalize the values before charting them.

| eval ExitStatus=if(ExitStatus>0, 1, 0)
| chart count by ExitStatus
---
If this reply helps you, Karma would be appreciated.
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...