MENU
Will the queries following below get the same result?
1. index=log sourcetype=error_log status !=100
2. index=log sourcetype=error_log NOT status =100
Suggested Answer: B
Get Premium SPLK-1001 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
12 comments · newest first
SH
Shizue
11 months ago
They should return the same results, I agree.
IE
Iesha
11 months ago
Wait, are you sure? That seems odd.
ER
Ernest
12 months ago
Definitely not the same!
MA
Magda
12 months ago
I think they might not be the same.
WH
Whitney
12 months ago
Both queries filter out status 100, so yes.
KA
Karma
1 year ago
I’m confused about the syntax; I feel like I’ve seen questions where the placement of NOT changes the outcome.
LI
Linette
1 year ago
I remember practicing something similar, and I feel like the NOT operator might behave differently in some cases.
KI
Kimberely
1 year ago
I think both queries should return the same results since they both filter out status 100, but I'm not entirely sure.
CO
Corazon
1 year ago
I’m leaning towards "No" because I think the way the conditions are structured could lead to different interpretations.
AR
Aretha
1 year ago
Hmm, this is an interesting question. I'll need to think through the different objectives and make sure I select the ones that are most relevant to profitability analysis. I don't want to overthink it, but I also want to make sure I get this right.
EL
Eleonora
1 year ago
I'm pretty confident that the answer is SPAN with Packet Brokers. That approach allows you to monitor traffic directly at the source, which is exactly what the question is asking for.
BU
Buffy
1 year ago
I think after establishing overall strategies, the next step is to select target markets, but I'm not completely sure.