https://community.splunk.com/t5/Splunk-Search/Search-for-JSON-data-that-does-not-contain-a-field/m-p/67405#M16857 <P>This will work:</P> <PRE><CODE>NOT message.request.authorization=* </CODE></PRE> <P>See also <A href="http://answers.splunk.com/answers/6981/which-is-better-not-or">http://answers.splunk.com/answers/6981/which-is-better-not-or</A></P> Thu, 19 Sep 2013 05:38:52 GMT gkanapathy 2013-09-19T05:38:52Z https://community.splunk.com/t5/Splunk-Search/Search-for-JSON-data-that-does-not-contain-a-field/m-p/67404#M16856 <P>We are sending Json formatted data into splunk. How can I search for all messages that that DO NOT contain a certain Json field, for e.g. I want to search all messages that don't contain the authorization field (fully qualified as message.request.authorization)? </P> Thu, 19 Sep 2013 04:58:51 GMT https://community.splunk.com/t5/Splunk-Search/Search-for-JSON-data-that-does-not-contain-a-field/m-p/67404#M16856 amanteja 2013-09-19T04:58:51Z https://community.splunk.com/t5/Splunk-Search/Search-for-JSON-data-that-does-not-contain-a-field/m-p/67405#M16857 <P>This will work:</P> <PRE><CODE>NOT message.request.authorization=* </CODE></PRE> <P>See also <A href="http://answers.splunk.com/answers/6981/which-is-better-not-or">http://answers.splunk.com/answers/6981/which-is-better-not-or</A></P> Thu, 19 Sep 2013 05:38:52 GMT https://community.splunk.com/t5/Splunk-Search/Search-for-JSON-data-that-does-not-contain-a-field/m-p/67405#M16857 gkanapathy 2013-09-19T05:38:52Z