<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Search not working but search for NOT != does work. in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/Why-is-Search-not-working-but-search-for-NOT-does-work/m-p/593043#M206427</link>
    <description>&lt;P&gt;Please refer to my answer here -&amp;nbsp;&lt;A href="https://community.splunk.com/t5/Splunk-Search/Simple-search-not-working-but-search-for-NOT-does-work/m-p/593042/highlight/true#M206426" target="_blank"&gt;https://community.splunk.com/t5/Splunk-Search/Simple-search-not-working-but-search-for-NOT-does-work/m-p/593042/highlight/true#M206426&lt;/A&gt;&lt;/P&gt;&lt;P&gt;---&lt;BR /&gt;Consider accepting/upvoting this answer if it is helpful!!!&lt;/P&gt;</description>
    <pubDate>Fri, 08 Apr 2022 05:16:32 GMT</pubDate>
    <dc:creator>VatsalJagani</dc:creator>
    <dc:date>2022-04-08T05:16:32Z</dc:date>
    <item>
      <title>Why is Search not working but search for NOT != does work?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Why-is-Search-not-working-but-search-for-NOT-does-work/m-p/593018#M206415</link>
      <description>&lt;P&gt;Hi All,&lt;/P&gt;
&lt;P&gt;I am doing a very simple search over All Time of:&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;index=index=orafin sourcetype=ORAFIN2&lt;/LI-CODE&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;It returns 26 rows and, as this shows, all have a transaction_type value:&lt;/P&gt;
&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="KeithH_0-1649368154063.png" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/18993i906C0C8385822370/image-size/medium?v=v2&amp;amp;px=400" role="button" title="KeithH_0-1649368154063.png" alt="KeithH_0-1649368154063.png" /&gt;&lt;/span&gt;&lt;/P&gt;
&lt;P&gt;If I then select D it adds that to the search but retuns NO rows:&lt;/P&gt;
&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="KeithH_1-1649368275778.png" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/18994iAE166BF269878D10/image-size/medium?v=v2&amp;amp;px=400" role="button" title="KeithH_1-1649368275778.png" alt="KeithH_1-1649368275778.png" /&gt;&lt;/span&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;Oddly if I change the search to a double negative&amp;nbsp; I get my data:&lt;/P&gt;
&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="KeithH_2-1649368798565.png" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/18995i2D3E02FD53DC17BF/image-size/medium?v=v2&amp;amp;px=400" role="button" title="KeithH_2-1649368798565.png" alt="KeithH_2-1649368798565.png" /&gt;&lt;/span&gt;&lt;/P&gt;
&lt;P&gt;Whats going on?&lt;/P&gt;
&lt;P&gt;Hoping to be enlightened,&lt;/P&gt;
&lt;P&gt;Keith&lt;/P&gt;</description>
      <pubDate>Fri, 08 Apr 2022 14:53:28 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Why-is-Search-not-working-but-search-for-NOT-does-work/m-p/593018#M206415</guid>
      <dc:creator>KeithH</dc:creator>
      <dc:date>2022-04-08T14:53:28Z</dc:date>
    </item>
    <item>
      <title>Re: Search not working but search for NOT != does work.</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Why-is-Search-not-working-but-search-for-NOT-does-work/m-p/593043#M206427</link>
      <description>&lt;P&gt;Please refer to my answer here -&amp;nbsp;&lt;A href="https://community.splunk.com/t5/Splunk-Search/Simple-search-not-working-but-search-for-NOT-does-work/m-p/593042/highlight/true#M206426" target="_blank"&gt;https://community.splunk.com/t5/Splunk-Search/Simple-search-not-working-but-search-for-NOT-does-work/m-p/593042/highlight/true#M206426&lt;/A&gt;&lt;/P&gt;&lt;P&gt;---&lt;BR /&gt;Consider accepting/upvoting this answer if it is helpful!!!&lt;/P&gt;</description>
      <pubDate>Fri, 08 Apr 2022 05:16:32 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Why-is-Search-not-working-but-search-for-NOT-does-work/m-p/593043#M206427</guid>
      <dc:creator>VatsalJagani</dc:creator>
      <dc:date>2022-04-08T05:16:32Z</dc:date>
    </item>
  </channel>
</rss>

