Deployment Architecture

Is there any limit for the "NOT" operator?


Hi Team,

I just want to know is there any limit for the "NOT" operator, same like join has? if yes, what is the limit?

Thank you.

Tags (2)
0 Karma


While I am not aware of limits for use of NOT, following two points should always be considered:

1) For search performance avoid using NOT, since inclusion is better than exclusion.

2) Both NOT and != are used to exclude results from search, however behavior is different for both.

| makeresults | eval message= "Happy Splunking!!!"
0 Karma


The NOT operator does exactly as it sounds.. It will exclude any string after NOT without limits.

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...