Correct, "C"is the good answer.
When you want to exclude results from your search you can use the NOT operator or the != field expression. However there is a significant difference in the results that are returned from these two methods.
If you search with the != expression, every event that has a value in the field, where that value does not match the value you specify, is returned. Events that do not have a value in the field are not included in the results.
If you search with the NOT operator, every event is returned except the events that contain the value you specify. This includes events that do not have a value in the field.
Reference: https://docs.splunk.com/Documentation/Splunk/latest/Search/NOTexpressions
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
DAL1998
2 months ago