how to filter by "does not equal"

[Techfrogger]

I know how to filter for a specific event so, for example, I always run this:
source=wineventlog:* earliest_time=-24h "Type=Success"
But what I'd now like to do is the opposite: I'd like to eliminate all these "successes" so I can see all the rest. Since I don't know what the rest are, I can't filter by them. Can I do something like "type DOES NOT EQUAL Success"?

[Keysofsandiego]

another example

foo search ... source=WinEventLog:Security | yadda yadda yadda

or the opposite

foo search ... source!=WinEventLog:Security | yadda yadda yadda

Its not easy to understand what people are saying when you are a newb as I am.

[wangweibee]

"not equal " is just "!="

[Ayn]

your_search Type!=Success | the_rest_of_your_search

without the quotes, otherwise Splunk will literally be looking for the string "Type!=Success". Also you might want to do NOT Type=Success instead. The reason for that is that Type!=Success implies that the field "Type" exists, but is not equal to "Success". If the "Type" field doesn't exist at all, the filtering expression will not match.

[kristian_kolb]

Don't be so humble. Converted it to an answer for you 🙂

[Marco]

@kristian_kolb 

LOL this comment made my day 8 years later

-Marco

[sowings]

It's possible that the only events with a 'Type' field defined are those where Type=Success. If that's true, then the third search (with !=) would have no field 'Type' against which to evaluate = or even !=.

Also consider absolute time frames, so that the time at which the search is executed isn't leading to different answers. Consider "yesterday" -> earliest=-1d@d latest=@d

[Techfrogger]

So why is that when I search on
source=wineventlog:* earliest_time=-24h
I get approximately 25,000 responses and when I search on
source=wineventlog:* earliest_time=-24h "Type=Success"
I get approximately 24,000
But when I then search on
source=wineventlog:* earliest_time=-24h "Type!=Success"
I get zero responses? I should get back approximately 1,000 responses. What am I doing wrong?

[sowings]

It's as simple as "Type!=Success".