https://community.splunk.com/t5/Splunk-Search/What-is-the-correct-syntax-of-applying-NOT-operator-in/m-p/471005#M132500 <P>Can you post sample log events?</P> Wed, 04 Sep 2019 04:29:58 GMT jawaharas 2019-09-04T04:29:58Z https://community.splunk.com/t5/Splunk-Search/What-is-the-correct-syntax-of-applying-NOT-operator-in/m-p/471004#M132499 <P>The following is the regex I am working on and what I'm trying to do is exclude any username events that ends with "ZLX" but I doubt that If I am following the right syntax. especially I am not sure if I can use "!" for excluding. </P> <PRE><CODE>REGEX = (logtype::A.*(id::(123|456)|(id::789.*username!::[a-zA-Z]{2,3}-+.*?-ZLX)) </CODE></PRE> Tue, 03 Sep 2019 21:52:51 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-correct-syntax-of-applying-NOT-operator-in/m-p/471004#M132499 pavanae 2019-09-03T21:52:51Z https://community.splunk.com/t5/Splunk-Search/What-is-the-correct-syntax-of-applying-NOT-operator-in/m-p/471005#M132500 <P>Can you post sample log events?</P> Wed, 04 Sep 2019 04:29:58 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-correct-syntax-of-applying-NOT-operator-in/m-p/471005#M132500 jawaharas 2019-09-04T04:29:58Z https://community.splunk.com/t5/Splunk-Search/What-is-the-correct-syntax-of-applying-NOT-operator-in/m-p/471006#M132501 <P>"(?(&lt;)! sub expression)" regex for negative look behind (remove the bracket before and after less then sign)</P> <P>"(?! sub expression)" regex for negative look ahead </P> <P>this might help you to update your regex accordingly</P> Wed, 04 Sep 2019 13:13:10 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-correct-syntax-of-applying-NOT-operator-in/m-p/471006#M132501 rahulbhatia 2019-09-04T13:13:10Z