1 ACCEPTED SOLUTION
Accepted Solutions
Theanysubquery condition is true if the expression returns true for one or more of the values returned by the subquery.
...
The
allsubquery condition is true if the expression returns true for all of the values returned by the subquery.
That said....you should only use ANY() and ALL() when evaluating multi-valued meta (i.e.: meta keys that can contain more than one meta value, such as alias.host, action, etc.)
For metakeys like user.src and user.dst (which should only ever have a single meta value per event/session), you're better off using syntax like:
- user_dst != user_src
- user_dst NOT IN (user_src, event_user, username)
Theanysubquery condition is true if the expression returns true for one or more of the values returned by the subquery.
...
The
allsubquery condition is true if the expression returns true for all of the values returned by the subquery.
That said....you should only use ANY() and ALL() when evaluating multi-valued meta (i.e.: meta keys that can contain more than one meta value, such as alias.host, action, etc.)
For metakeys like user.src and user.dst (which should only ever have a single meta value per event/session), you're better off using syntax like:
- user_dst != user_src
- user_dst NOT IN (user_src, event_user, username)
