Skip to main content
Use the not function in APL to reverse the boolean value of an expression. It returns true when the input is false, and false when the input is true. not is useful for inverting filter conditions, flagging events that fail a specific test, and building readable logical expressions. It makes queries easier to understand than using == false or != true directly.

​
For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, NOT is a keyword used in search or where clauses. In APL, not() is a function that wraps a boolean expression and can be used in extend, where, and project operators.
| where NOT status='500'
In ANSI SQL, NOT is a keyword that negates a boolean expression. In APL, not() is a function with the same effect.
SELECT * FROM logs WHERE NOT status = '500'

​
Usage

​
Syntax

not(expr)

​
Parameters

NameTypeRequiredDescription
exprboolYesThe boolean expression to reverse.

​
Returns

true if expr is false. false if expr is true.

​
Example

Use not to identify requests using non-standard HTTP methods, which can be a sign of reconnaissance or abuse. Query 
['sample-http-logs']
| extend is_safe_method = (method == 'GET' or method == 'HEAD')
| where not(is_safe_method)
| project _time, id, status, method, uri
Run in Playground Output
_timeidstatusmethoduri
2024-11-14 10:00:00user-9200POST/api/data
2024-11-14 10:01:00user-5403DELETE/admin/users
POST, PUT, DELETE, and other non-GET/HEAD methods appear here. Unexpected DELETE or PUT requests to sensitive endpoints may warrant investigation.
  • isfinite: Returns true for finite values. Combine with not as not(isfinite(x)) to filter out invalid numeric results.
  • isinf: Returns true for infinite values. Use not(isinf(x)) as an alternative to isfinite when NaN values are not a concern.
  • isnan: Returns true for NaN. Use not(isnan(x)) to keep only valid numeric rows.
  • isint: Returns true for integers. Use not(isint(x)) to keep only non-integer values.
  • sign: Returns the sign of a value. Use it when you need a numeric result rather than a boolean negation.