Splunk Search

How to search through events that do not have a specific field?

Builder

Hi
I would like to search through my events that do not have the field "rerun". I am trying to do something like this:

| search field!=rerun
Tags (2)
0 Karma
1 Solution

Splunk Employee
Splunk Employee
| search NOT rerun=*

View solution in original post

Influencer

| fillnull value="foobar" rerun | search rerun="foobar"

0 Karma

Splunk Employee
Splunk Employee
| search NOT rerun=*

View solution in original post