Table of Contents | ||||
---|---|---|---|---|
|
Description
You can apply this operation either as a Filter or Create columnfield operation:
Filter | Compares two values of the same type and returns only the events where both values are not the same. |
---|---|
Create |
field | Compares two values of the same type and creates a Boolean column that shows true when both values are not the same. |
---|
Note |
---|
Note that this operation is case sensitive, that is to say, same values in lowercase and uppercase will be considered as not equal. |
How does it work in the search window?
Select Filter / Create column field in the search window toolbar, then select the Not equal operation. You need to specify two arguments:
Argument | Data type |
---|---|
Value mandatory | Any |
is not equal to mandatory | The same as the Value data type |
If you use the Create columnfield operation, the data type of the values in the new column is boolean (true or false).
Example
In the demosiem.logtrust.ecommerceweb.dataactivity
table, we want to get only the events whose status code method is different than 200to GET. To do it, we will apply a Filter using the Not equal operation.
The arguments needed for the filter are:
Value - statusCode columnMethod field
is not equal to - Click the pencil icon and enter 200GET
...
Click Filter data and you will see the following result:
...
Click Create columnfield and follow the same steps to add a new Boolean column that shows true when the values in the statusCode column method field are different than 200GET.
How does it work in LINQ?
Use the operator where
... to apply the Filter operation and select
... as
... to apply the Create column operation. These are the valid formats of the Not equal operation:
value1 /= value2
ne(
value1, value2
)
Examples
You can copy the following LINQ scripts and try the above example on the demo.ecommerce.data
table:
Code Block |
---|
from demo.ecommerce.data where statusCode /= 200 |
...
Code Block |
---|
from demo.ecommerce.data where ne(statusCode, 200) |
And this is the same example using the Create column operation:
Code Block |
---|
from demo.ecommerce.data select statusCode /= 200 as code_not_200 |
...