Splunk Search

difference between NOT and !=

Olli1919
Path Finder

Hi fellow Splunkers,

I just fell over the difference between "NOT src_ip=1.2.3.4" and "src_ip!=1.2.3.4" in a basesearch. Can someone explain what the difference is and why?

What I did was to use this statement in a basesearch, filtering out this single IP. What happens is:
- "src_ip!=1.2.3.4": Filters out this single IP and all events with src_ip being null
- "NOT src_ip=1.2.3.4": Filters out this single IP, leaves all events with null src_ip standing

I know that "NOT src_ip=*" is the best way to search for empy or null occurences of src_ip. But I figure I should understand what is happening under the hood as well.

Thanks for the enlightenment.

Olli

Tags (3)
0 Karma
1 Solution

schose
Builder

"fieldname!=value" expect only matches events where the does field exist. NOT does not and matches also events where the field does not exist.

View solution in original post

schose
Builder

"fieldname!=value" expect only matches events where the does field exist. NOT does not and matches also events where the field does not exist.

inventsekar
Ultra Champion

from the splunk search manual...

Difference between NOT and !=
When you want to exclude results from your search you can use the NOT
operator or the != field expression. However there is a significant difference in the
results that are returned from these two methods.

Suppose you have the following fields:
· fieldA
· fieldB
· fieldC
Each of these fields has 3 values, for example fieldA has value1, value2, and
value3.

If you search for fieldB!=value3, the search returns only those values for
fieldB that are not value3:
· fieldB=value1, fieldB=value2
If fieldB does not exist, nothing is returned.

If you search for NOT fieldB=value3, the search returns everything except
fieldB=value3:
· fieldA=value1, fieldA=value2, fieldA=value3
· fieldB=value1, fieldB=value2
· fieldC=value1, fieldC=value2, fieldC=3

If fieldB does not exist, NOT fieldB=value3 returns:
· fieldA=value1, fieldA=value2, fieldA=value3
· fieldC=value1, fieldC=value2, fieldC=3

0 Karma

Olli1919
Path Finder

Thinking about it, I would assume that "src_ip!=" needs a fieldvalue to compare with. Probably a "check this fieldvalue, remove the match". So if no fieldvalue is there, the the clause cannot come back being positive, because it cannot be checked.

Whereas "NOT src_ip" negates the clause. Which is negative when either this wanted value exists or when the field cannot be checked. So on both occurences it comes back negative, negated again gives a positive.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...