Description of problem: We try to search hosts not in specified host collection using !=, example: host_collection != AnsibleTower-PR this does not work. Version-Release number of selected component (if applicable): Satellite 6.x Actual results: When we search for any host which does not belong to any host_collection using the filter host_collection != it does not give any answer. Expected results: It should give the right answer. Additional info / workaround: "not host_collection = Test" instead of "host_collection != Test" to make it work
*** Bug 2158849 has been marked as a duplicate of this bug. ***
If you search with the != expression, every event that has a value in the field, where that value does not match the value you specify, is returned. Events that do not have a value in the field are not included in the results. If you search with the NOT operator, every event is returned except the events that contain the value you specify. This includes events that do not have a value in the field. For more information, please check: https://docs.splunk.com/Documentation/SplunkCloud/latest/Search/NOTexpressions. So the search filter is working as designed.
Hi Lucy, I previously opened bz 2158849 which was closed in favor of this one. In https://bugzilla.redhat.com/show_bug.cgi?id=2158849#c1 you can see that when using != in the search the query is built in such a way as to fail. To highlight the line; ~~~ WHERE "katello_host_collections"."name" <> 'test3' )))) ORDER BY "hosts".""name ASC LIMIT $2 OFFSET $3 ~~~ You can see there Satellite builds the query with this "hosts".""name bit, where name is not closed by a ". These queries can be ambiguous in nature when trying to know what to expect for a return, but surely we should expect the query to be built correctly before trusting what was returned?