topic "NOT TERM" removes results in Splunk Search

"NOT TERM" removes results

landen99 — Mon, 02 Dec 2019 12:51:13 GMT

When using NOT TERM, please keep in mind the following bug (see the answer for the workaround):

index=myindex NOT TERM(b=c)

will yield zero results if all the events contain “a_b=c” like this:

foo a_b=c b=d bar

The problem appears to exist only for normal searches using NOT on TERM where “b=c” exists in other places like “a_b=c”. It does not appear when using tstats. It seems to be a post-search filter.

Re: "NOT TERM" removes results

landen99 — Wed, 30 Sep 2020 03:13:23 GMT

The work-around appears to be to explicitly include “TERM(a_b=c)” like this:
index=myindex TERM(a_b=c) NOT TERM(b=c)

Re: "NOT TERM" removes results

woodcock — Mon, 02 Dec 2019 16:11:10 GMT

Also be aware of this:
https://docs.splunk.com/Documentation/Splunk/latest/Search/NOTexpressions

Re: "NOT TERM" removes results

mhoogcarspel_sp — Mon, 02 Dec 2019 17:28:23 GMT

That's not a bug I think, it's just "b=c" is not a term in the lexicon

fake results:

| makeresults 
| eval _raw="foo a_b=c b=d bar" 
| collect

can find it:

index=summary NOT TERM(b=c)

can't find it:

index=summary NOT TERM(*b=c)

validate:

| walklex index=summary 
| table * 
| search term="*b=c*"

tested on 8.0.1

("_" is a minor segmenter)
https://docs.splunk.com/Documentation/Splunk/8.0.0/Admin/Segmentersconf

https://docs.splunk.com/Documentation/Splunk/8.0.0/Search/UseCASEandTERMtomatchphrases

TERM: Match whatever is inside the
parentheses as a single term in the
index, even if it contains characters
that are usually recognized as minor
segmenters, such as periods or
underscores.
...

The TERM directive is useful when you
are searching for a term:

That contains minor breakers
Is bound by major breakers, such as spaces or commas Does not contain
major breakers

and your term isn't bound by major breakers, but a major (the space) and a minor one (the "_")

Re: "NOT TERM" removes results

mhoogcarspel_sp — Tue, 03 Dec 2019 09:33:24 GMT

Don't think this is accurate, have a look at my answer below

Re: "NOT TERM" removes results

landen99 — Sat, 07 Dec 2019 03:08:47 GMT

It is accurate. Martin Mueller has verified it too.