How can I return events with excluded field value combined with all events that have no value for that field?

[foxglove]

Hello all.

I've been having some trouble with a tricky query. Essentially, I want to return all events that contain a certain field, with a specific value excluded, and combine that with all events that also contain nothing for that particular field.

For excluding the field value, I would use:

... field!=value

And for all events that do not have a value for that field, I would use:

... NOT field="*"

I have no idea how to combine these, as one requires the field and the other completely excludes it. I have tried:

<search> field!=value
 | fields -field

But it doesn't work, as I believe I'm basically applying a filter but doing nothing with it.

Any help will be greatly appreciated! Thank you.

[2ero · Accepted solution]

I believe what you're looking to do should be implicitly solved by searching

NOT field=value

When searching with != you are also telling Splunk to only return results with a valid entry for that field. Take a look at the documentation for Difference between != and NOT for an in-depth  breakdown of the differences.

But @foxglove your question is a bit ambiguous, are you searching against two separate fields, looking for both null/nonexistent value and non-excluded values, or only null/nonexistent values that also don't match the searched value?

[foxglove]

Apologies for the ambiguity. I did mean the same field. Your solution is what I was looking for, so thank you. I forgot about the implicit nature of NOT in that it excludes all events that have a particular value for that field, which would include all events that do not any value for that field at all. Thanks again!

[bowesmana]

So you want this?

search .... (field!=value OR NOT field=*)