Hi Team,
I just want to know is there any limit for the "NOT" operator, same like join has? if yes, what is the limit?
Thank you.
While I am not aware of limits for use of NOT, following two points should always be considered:
1) For search performance avoid using NOT, since inclusion is better than exclusion. http://docs.splunk.com/Documentation/Splunk/6.5.1/Search/Writebettersearches#Avoid_using_NOT_express...
2) Both NOT and != are used to exclude results from search, however behavior is different for both. http://docs.splunk.com/Documentation/Splunk/6.5.1/Search/NOTexpressions
The NOT operator does exactly as it sounds.. It will exclude any string after NOT without limits.
NOT
