Your 1st query is searching for the events having the keyword 'search' (along with other conditions given the query). The events which doesn't have the 'search' keyword are dropped from your search result. Hence the different results you see.
The keyword 'search' should be after the '|' in your 1st query. Either remove the keyword 'search' from the query or add '|' symbol before 'search' keyword.
Please vote if you think this answer provided required clarification for you.
Yes, but aside from the typo, it's still a valuable question. The difference between the two
sourcetype="source" NOT field2=*keyword* | table field1, field2, field3
sourcetype="source" | table field1, field2, field3 | search NOT field2=*keyword*
is that the first one is slightly faster. They both should return the same result, but the first one eliminates a key:value pair before putting it into a table (which takes cycles.) The second one builds the table, then removes stuff.