Why is searching with NOT or != being ignored in search results?

[cdupuis123]

Anyone else seen this before? I'm building a search, then telling Splunk to NOT or using field!=something and Splunk is straight up ignoring it and showing the field anyway I've tried using quotes, NOT versus != and explicit typing out the value instead of using a wildcard.

[tskinnerivsec]

If you use NOT, try using parens around the search string you are trying to exclude. I've also seen it make a difference whether you are using a raw search or a datamodel / tstats search. When using !=, make sure to be specifying a field, such as query !="*.arpa". There are plenty of times, I have to monkey around with the order of my syntax, but ultimately, I can get data excluded from search results. Just be careful with your use of wildcards, quotes and make sure that the field names actually exist when using !=

[richgalloway]

The last time this happened to me, I had spelled the field name incorrectly.

Please share samples of your data and your failed searches so we figure out what's wrong.