Refine your search:

Which is better NOT or !=

2
2

Here are two searches that are the same.

NOT FIELD="value"

FIELD!="value"

Which should be used? Is this just a personal preference or are there any performance differences between the two.

There are lots of cases where the NOT prefixes a much more complex search, but I'm just wondering about this simple case.

asked 17 Sep '10, 19:57

skeetermurphy's gravatar image

skeetermurphy
35●2
accept rate: 0%

2

These searches are not the same. See below.

(17 Sep '10, 21:12) gkanapathy ♦
One Answer:
oldestnewestmost voted
9

These two searches are not the same.

NOT field="value" will return events where field is undefined (or null). field!="value" will only return events where field exists (and does not have the value "value").

In the case where the value in question is "*", NOT field=* will return events where field is null/undefined. field!=* will never return any events.

link

answered 17 Sep '10, 21:11

gkanapathy's gravatar image

gkanapathy ♦
26.5k●1●6●22
accept rate: 42%

edited 17 Sep '10, 21:56

Post your answer
toggle preview

Copyright © 2005-2012 Splunk, Inc. All rights reserved.