Here are two searches that are the same.
Which should be used? Is this just a personal preference or are there any performance differences between the two.
There are lots of cases where the NOT prefixes a much more complex search, but I'm just wondering about this simple case.
These two searches are not the same.
NOT field="value" will return events where field is undefined (or null). field!="value" will only return events where field exists (and does not have the value "value").
In the case where the value in question is "*", NOT field=* will return events where field is null/undefined. field!=* will never return any events.
View solution in original post
These searches are not the same. See below.