In the below search I am looking for rules hit by count, but how or where would I add a NOT or !, if I wanted to know what rules have not be hit.
index=pan_logs | fields _time, rule | stats count by rule | sort -count
Does PAN log rules that are not hit? I suspect not, but if it does then you'll have to modify your search to find those events.
Finding something that is not there is not Splunk's strong suit. See this blog entry for a good write-up on it.https://www.duanewaddle.com/proving-a-negative/
