https://community.splunk.com/t5/Splunk-Search/Show-only-events-WITHOUT-field/m-p/39725#M9090 <P>Is there a way to show events only if they do <EM>not</EM> contain a specified field. E.g. 40% of my selected events contain a field named Action. I need to access the 60% of events that do not contain the Action field.</P> Mon, 30 Aug 2010 20:57:50 GMT landzaat 2010-08-30T20:57:50Z https://community.splunk.com/t5/Splunk-Search/Show-only-events-WITHOUT-field/m-p/39725#M9090 <P>Is there a way to show events only if they do <EM>not</EM> contain a specified field. E.g. 40% of my selected events contain a field named Action. I need to access the 60% of events that do not contain the Action field.</P> Mon, 30 Aug 2010 20:57:50 GMT https://community.splunk.com/t5/Splunk-Search/Show-only-events-WITHOUT-field/m-p/39725#M9090 landzaat 2010-08-30T20:57:50Z https://community.splunk.com/t5/Splunk-Search/Show-only-events-WITHOUT-field/m-p/39726#M9091 <P>Simply add this to your search:</P> <PRE><CODE>NOT Action="*" </CODE></PRE> <P>Here is some helpful related discussion: <A href="http://answers.splunk.com/questions/310/how-can-i-search-for-a-missing-field">http://answers.splunk.com/questions/310/how-can-i-search-for-a-missing-field</A></P> Mon, 30 Aug 2010 21:01:15 GMT https://community.splunk.com/t5/Splunk-Search/Show-only-events-WITHOUT-field/m-p/39726#M9091 Lowell 2010-08-30T21:01:15Z