not

not is useful for inverting filter conditions, flagging events that fail a specific test, and building readable logical expressions. It makes queries easier to understand than using == false or != true directly.

Usage#

Syntax#

not(expr)

Parameters#

Name	Type	Required	Description
`expr`	bool	Yes	The boolean expression to reverse.

Returns#

true if expr is false. false if expr is true.

Example#

Use not to identify requests using non-standard HTTP methods, which can be a sign of reconnaissance or abuse.

Query

['sample-http-logs']
| extend is_safe_method = (method == 'GET' or method == 'HEAD')
| where not(is_safe_method)
| project _time, id, status, method, uri

Run in Playground

Output

_time	id	status	method	uri
2024-11-14 10:00:00	user-9	200	POST	/api/data
2024-11-14 10:01:00	user-5	403	DELETE	/admin/users

POST, PUT, DELETE, and other non-GET/HEAD methods appear here. Unexpected DELETE or PUT requests to sensitive endpoints may warrant investigation.

isfinite: Returns true for finite values. Combine with not as not(isfinite(x)) to filter out invalid numeric results.
isinf: Returns true for infinite values. Use not(isinf(x)) as an alternative to isfinite when NaN values aren't a concern.
isnan: Returns true for NaN. Use not(isnan(x)) to keep only valid numeric rows.
isint: Returns true for integers. Use not(isint(x)) to keep only non-integer values.
sign: Returns the sign of a value. Use it when you need a numeric result rather than a boolean negation.

Other query languages#

Splunk SPL users

In Splunk SPL, NOT is a keyword used in search or where clauses. In APL, not() is a function that wraps a boolean expression and can be used in extend, where, and project operators.

Splunk example

| where NOT status='500'

APL equivalent

['sample-http-logs']
| where not(status == '500')

ANSI SQL users

In ANSI SQL, NOT is a keyword that negates a boolean expression. In APL, not() is a function with the same effect.

SQL example

SELECT * FROM logs WHERE NOT status = '500'