Q: 20
Will the queries following below get the same result?
1. index=log sourcetype=error_log status !=100
2. index=log sourcetype=error_log NOT status =100
Options
Discussion
Nah, I don’t think it’s A. B is correct here since != drops events with no status field but NOT status=100 keeps them. Easy trap if you miss the missing field case.
Its B. The != operator ignores events without a status field but NOT status=100 will include them, so results don't always match. Seen folks miss this detail on practice exams, be careful with field existence logic.
Probably B. Main thing is that
!= ignores events where the field is missing, but NOT field=val includes them. Easy to miss if you don't think about null fields. Trap for A here.Had something like this in a mock, pretty sure it's B.
B
Seen similar logic questions in practice sets, and the official docs are useful for stuff like this. Good idea to review SPL query behavior, especially how NOT and != work.
Be respectful. No spam.
