Splunk Search

Working with the NOT command

jialiu907
Path Finder

So I am trying to search through some results and I am trying to display the results that ExitStatus=0 which means it ran correctly and ExitStatus=anything else which is not 0, meaning it is an error. I am looking to have a pie chart which it shows either ExitStatus=0 or ExitStatus= NOT 1. 

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There are two ways to do a negative test in SPL - the NOT operator and the != operator.  Each has slightly different syntax and behaves slightly differently.

| eval result=if(ExitStatus!=0, "Error", "Success")

The != operator looks at events that have an ExitStatus field that has a value.  Nulls are ignored.

| eval result=if(NOT ExitStatus=0, "Error", "Success")

The NOT operator looks at all events, even those that do not have an ExitStatus field.  Nulls are included.  A null does not match the target value.

That said, I think you don't need either operator.  Just have the pie chart show how many of each ExitStatus there is.

| chart count by ExitStatus

If you really want only 2 values displayed then you can normalize the values before charting them.

| eval ExitStatus=if(ExitStatus>0, 1, 0)
| chart count by ExitStatus
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

There are two ways to do a negative test in SPL - the NOT operator and the != operator.  Each has slightly different syntax and behaves slightly differently.

| eval result=if(ExitStatus!=0, "Error", "Success")

The != operator looks at events that have an ExitStatus field that has a value.  Nulls are ignored.

| eval result=if(NOT ExitStatus=0, "Error", "Success")

The NOT operator looks at all events, even those that do not have an ExitStatus field.  Nulls are included.  A null does not match the target value.

That said, I think you don't need either operator.  Just have the pie chart show how many of each ExitStatus there is.

| chart count by ExitStatus

If you really want only 2 values displayed then you can normalize the values before charting them.

| eval ExitStatus=if(ExitStatus>0, 1, 0)
| chart count by ExitStatus
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...