Search for JSON data that does not contain a field

[amanteja]

We are sending Json formatted data into splunk. How can I search for all messages that that DO NOT contain a certain Json field, for e.g. I want to search all messages that don't contain the authorization field (fully qualified as message.request.authorization)?

[gkanapathy · Accepted solution]

This will work:

NOT message.request.authorization=*

See also http://answers.splunk.com/answers/6981/which-is-better-not-or