Query logic not short circuiting?
From what I can tell, Sumo Logic queries don't appear to perform short-circuit evaluation. Is this correct?
It's common in many programming languages for logical statements to be evaluated as a "short circuit".
https://en.wikipedia.org/wiki/Short-circuit_evaluation
e.g. for "A and B", if "A" is evaluated to false, the whole expression is false, and there is no need to evaluate "B"
For example (where src_ip is from field extraction rules):
This query displays an error:
_sourceCategory=*
| count as count by src_ip
// filter out internal and blank IPs
| where !(isBlank(src_ip) or src_ip = "0.0.0.0" or compareCIDRPrefix("192.168.0.0", src_ip, toInt(16)) or compareCIDRPrefix("10.0.0.0", src_ip, toInt(8)) or compareCIDRPrefix("172.16.0.0", src_ip, toInt(12)) or compareCIDRPrefix("127.0.0.0", src_ip, toInt(8)))
This query evaluates without error:
_sourceCategory=*
| count as count by src_ip
// Filtering out blank values first
| where !(isBlank(src_ip))
| where !(src_ip = "0.0.0.0" or compareCIDRPrefix("192.168.0.0", src_ip, toInt(16)) or compareCIDRPrefix("10.0.0.0", src_ip, toInt(8)) or compareCIDRPrefix("172.16.0.0", src_ip, toInt(12)) or compareCIDRPrefix("127.0.0.0", src_ip, toInt(8)))
I'd like to confirm/clarify whether short-circuit evaluation is performed, as it will influence how our queries are written.
Please sign in to leave a comment.
Comments
2 comments