To apply to multiple terms, you must enclose the terms in parenthesis.Īn exclusive OR. The NOT operator only applies to the term immediately following NOT. The expressions cannot be equal to one another. One of the expressions must evaluate to TRUE. So unless you want to include it for clarity reasons, you should not need to specify the AND operator. The AND operator is always implied between terms, that is: web error is the same as web AND error. The supported operators are describe in the following table: Relational operators evaluate whether the expressions are equal to, not equal to, greater than or less than on another, The relational operators are symbols that compare one expression with another expression. See Quick Reference for SPL2 eval functions in the SPL2 Search Reference. Evaluation functions, such as in, isnum, like, and match are examples of functions that return TRUE.

WHERE ipaddress LIKE '198.%'Ī function that returns a Boolean. | FROM main AS m1 WHERE EXISTS (SELECT 1 FROM main WHERE host=m1.host AND host=| search status IN (401, 403). Conditional and pattern matching operators include: The supported logical operators are: AND, OR, NOT, and XOR.Ī=1 AND ( B=2 OR C=3 ) error NOT (403 OR 404)Ĭonditional and pattern-matching operatorsĪ predicate expression that uses a keyword operator to test for a condition or match a pattern. Examples of relational operators are equal to ( = ) and is greater than ( > ).Īn operator that performs a comparison between two expression. Relational operators use symbols to check for equality, inequality, or relative order between two expressions. The following table describes the types of predicate operators that you can use in expressions: The following predicate expression uses the in function to filter the results in the status field. Predicates are often used to filter data or specify a condition to reduce the number of search results. See the from command overview and the where command overview in the SPL2 Search Reference. You can use predicate expressions in the WHERE and HAVING clauses in the from command, and in the where command. The result of that equation is a Boolean. Think of a predicate expression as an equation. A predicate expression, when evaluated, returns either TRUE or FALSE. A predicate is an expression that consists of operators or keywords that specify a relationship between two expressions.

In splunk query