When using NOT TERM, please keep in mind the following bug (see the answer for the workaround):
index=myindex NOT TERM(b=c)
will yield zero results if all the events contain “a_b=c” like this:
foo a_b=c b=d bar
The problem appears to exist only for normal searches using NOT on TERM where “b=c” exists in other places like “a_b=c”. It does not appear when using tstats. It seems to be a post-search filter.
The work-around appears to be to explicitly include “TERM(a_b=c)” like this:
index=myindex TERM(a_b=c) NOT TERM(b=c)
That's not a bug I think, it's just "b=c" is not a term in the lexicon
fake results:
| makeresults
| eval _raw="foo a_b=c b=d bar"
| collect
can find it:
index=summary NOT TERM(b=c)
can't find it:
index=summary NOT TERM(*b=c)
validate:
| walklex index=summary
| table *
| search term="*b=c*"
tested on 8.0.1
("_" is a minor segmenter)
https://docs.splunk.com/Documentation/Splunk/8.0.0/Admin/Segmentersconf
https://docs.splunk.com/Documentation/Splunk/8.0.0/Search/UseCASEandTERMtomatchphrases
TERM: Match whatever is inside the
parentheses as a single term in the
index, even if it contains characters
that are usually recognized as minor
segmenters, such as periods or
underscores.
...The TERM directive is useful when you
are searching for a term:That contains minor breakers
Is bound by major breakers, such as spaces or commas Does not contain
major breakers
and your term isn't bound by major breakers, but a major (the space) and a minor one (the "_")
Also be aware of this:
https://docs.splunk.com/Documentation/Splunk/latest/Search/NOTexpressions
The work-around appears to be to explicitly include “TERM(a_b=c)” like this:
index=myindex TERM(a_b=c) NOT TERM(b=c)
Don't think this is accurate, have a look at my answer below
It is accurate. Martin Mueller has verified it too.