How to search all field values except a particular one?

[summitsplunk]

I have an app that can show source by country

Example:
Country=China

In SPL how would I format this if I wanted to Search like all possible values for Country except like USA?

[cmerriman · Accepted solution]

try Country!=*USA* if there is a wildcard, not that I can imagine a wildcard in the country.
otherwise, Country!="USA" or NOT Country="USA" should do the trick

it should be noted that when using !=, any event that does not include Country will also be excluded whereas when using NOT, events where Country doesn't exist will come back as well. So if Country is in 80% of your events and you only want to exclude "USA" but want to include events without Country, use NOT Country="USA". If you want to exclude both null country values as well as USA, use Country!="USA"