https://community.splunk.com/t5/Splunk-Search/Search-for-logs-which-are-NOT-key-value/m-p/202486#M58766 <P>Does anyone have a data curation search that I snag? Looking for logs and values which are not currently done in key values. </P> Thu, 29 Oct 2015 00:04:44 GMT daniel333 2015-10-29T00:04:44Z https://community.splunk.com/t5/Splunk-Search/Search-for-logs-which-are-NOT-key-value/m-p/202486#M58766 <P>Does anyone have a data curation search that I snag? Looking for logs and values which are not currently done in key values. </P> Thu, 29 Oct 2015 00:04:44 GMT https://community.splunk.com/t5/Splunk-Search/Search-for-logs-which-are-NOT-key-value/m-p/202486#M58766 daniel333 2015-10-29T00:04:44Z https://community.splunk.com/t5/Splunk-Search/Search-for-logs-which-are-NOT-key-value/m-p/202487#M58767 <P>Hi daniel333, Check out the Patterns tab : <A href="http://docs.splunk.com/Documentation/Splunk/6.3.0/Search/Identifyeventpatterns">http://docs.splunk.com/Documentation/Splunk/6.3.0/Search/Identifyeventpatterns</A></P> <P>Search on a particular source or sourcetype, and it will give you an idea of what kind of events are in that data. At that point you might be able to pick out fields that you can build extractions on.</P> <P>Let me know if this helps! </P> Thu, 29 Oct 2015 01:13:44 GMT https://community.splunk.com/t5/Splunk-Search/Search-for-logs-which-are-NOT-key-value/m-p/202487#M58767 muebel 2015-10-29T01:13:44Z https://community.splunk.com/t5/Splunk-Search/Search-for-logs-which-are-NOT-key-value/m-p/202488#M58768 <P>Did you try... </P> <PRE><CODE> your search ... key!=value </CODE></PRE> <P>This should give the events which doesnt have the values for the key specified above.</P> Thu, 29 Oct 2015 09:25:05 GMT https://community.splunk.com/t5/Splunk-Search/Search-for-logs-which-are-NOT-key-value/m-p/202488#M58768 krish3 2015-10-29T09:25:05Z