Comparison operators

The equal operator

To find data in a specific field, use the equal operator (=). The equal operator is used for exact matching entire field values.

For example:

  rawmsg="test"

Result: would return all events where the entire rawmsg contents are exactly 'test'.

When the equals operator is used with a list of fields, the matching logic changes from an exact match to a partial match. HE splits the values in the specified fields into individual tokens. If any token with those fields matches a value in your list, the event is returned. Characters such as periods, dashes, and spaces act as delimiters.

For example, you have a list called $mylist that contains the value user.004, and you want to return the username that has the value 004. There are two scenarios:

The colon operator

To find data that is the result of an analysis operation, such as an analyzed field value or results of an executed prefix operation, use the colon operator (:).

For example:

  rawmsg:"test"

Result: performs a search for 'test' in the rawmsg contents.

Other operators

In addition to equals, the other supported operator values are:

Spaces are permitted around the operators for the purpose of clarity.

Operator values are the tightest binding.

For example:

  rcvdpackets > 20

  !rcvdpackets <= 20