Query logic not short circuiting?

From what I can tell, Sumo Logic queries don't appear to perform short-circuit evaluation. Is this correct?

It's common in many programming languages for logical statements to be evaluated as a "short circuit".
https://en.wikipedia.org/wiki/Short-circuit_evaluation
e.g. for "A and B", if "A" is evaluated to false, the whole expression is false, and there is no need to evaluate "B"

For example (where src_ip is from field extraction rules):

This query displays an error:

_sourceCategory=*
| count as count by src_ip
// filter out internal and blank IPs
| where !(isBlank(src_ip) or src_ip = "0.0.0.0" or compareCIDRPrefix("192.168.0.0", src_ip, toInt(16)) or compareCIDRPrefix("10.0.0.0", src_ip, toInt(8)) or compareCIDRPrefix("172.16.0.0", src_ip, toInt(12)) or compareCIDRPrefix("127.0.0.0", src_ip, toInt(8)))

This query evaluates without error:

_sourceCategory=*
| count as count by src_ip
// Filtering out blank values first
| where !(isBlank(src_ip))
| where !(src_ip = "0.0.0.0" or compareCIDRPrefix("192.168.0.0", src_ip, toInt(16)) or compareCIDRPrefix("10.0.0.0", src_ip, toInt(8)) or compareCIDRPrefix("172.16.0.0", src_ip, toInt(12)) or compareCIDRPrefix("127.0.0.0", src_ip, toInt(8)))

I'd like to confirm/clarify whether short-circuit evaluation is performed, as it will influence how our queries are written.

Latimer Luis

October 25, 2018 22:21

Hi Nathaniel -

Short-circuit evaluation is not performed; hence, the errors you were seeing with the initial query. Your query that evaluates without error would be the recommended approach to ensuring that only non-null values are passed onto the next operation.

Nathaniel Jensen

October 25, 2018 23:07

Hi Latimer,
Thanks for the response.
I'd just wanted confirmation that this was expected behaviour.

Query logic not short circuiting?

Comments

Didn't find what you were looking for?