RSS

Splunk Search Condition != vs. NOT

Different between != and NOT in Splunk search.

When you want to exclude results from your search you can use the NOT operator or the != field expression.

However there is a significant difference in the results that are returned from these two methods.

!= vs. NOT Comparison

  • Both!= field expression and NOT operator exclude events from your search, but produce different results
  • Example: status != 200
    • Returns events where status field exists and value in field doesn’t equal 200
  • Example: NOT status = 200
    • Returns events where status field exists and value in field doesn’t equal 200 – and all events where status field doesn’t exist
  • Does != and NOT ever yield the same results?
    • Yes, if you know the field you’re evaluating always exists in the data you’re searching
    • For example:
      • index=web sourcetype=access_combined status!=200
      • index=web sourcetype=access_combined NOT status=200 yields same results because status field always exists in access_combined sourcetype.

Splunk search != vs. NOT result comparison

Searching with != or NOT is not efficient

Using the != expression or NOT operator to exclude events from your search results is not an efficient method of filtering events. The execution cost for a search is actually less when you explicitly specify the values that you want to include in the search results.

Reference