Deployment Architecture

Is there any limit for the "NOT" operator?


Hi Team,

I just want to know is there any limit for the "NOT" operator, same like join has? if yes, what is the limit?

Thank you.

Tags (2)
0 Karma


While I am not aware of limits for use of NOT, following two points should always be considered:

1) For search performance avoid using NOT, since inclusion is better than exclusion.

2) Both NOT and != are used to exclude results from search, however behavior is different for both.

| makeresults | eval message= "Happy Splunking!!!"
0 Karma


The NOT operator does exactly as it sounds.. It will exclude any string after NOT without limits.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...