How come our negative field search is looking in all the fields instead of the searched field?

[jonaspereira]

I have a Splunk local installation that is having some strange behavior. The search is filtered by negative field extractions before a specific date, and it isn't retrieving the expected results. The negative search is being applied to all the fields.

So, for example, if I search for 'FieldA="foo" AND FieldB!="foo", no results will be retrieved even if none of the entries in FieldB have "foo" as a value.

[493669]

check if there is any space or tab in value and to remove spaces you can use trim function as

|eval FieldA=trim(FieldA), FieldB=trim(FieldB)

try this run anywhere run search which works as expected if there is no space in values-

| makeresults |eval a="foo", b="f"|append[| makeresults |eval a="boo", b="ghh"]|append[| makeresults |eval a="foo", b="fsi"]|append[| makeresults |eval a="foo", b="foo"]
|search a="foo" b!="foo"