Splunk Search
Highlighted

Why is searching with NOT or != being ignored in search results?

Path Finder

Anyone else seen this before? I'm building a search, then telling Splunk to NOT or using field!=something and Splunk is straight up ignoring it and showing the field anyway I've tried using quotes, NOT versus != and explicit typing out the value instead of using a wildcard.

Tags (1)
0 Karma
Highlighted

Re: Why is searching with NOT or != being ignored in search results?

SplunkTrust
SplunkTrust

The last time this happened to me, I had spelled the field name incorrectly.

Please share samples of your data and your failed searches so we figure out what's wrong.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: Why is searching with NOT or != being ignored in search results?

Contributor

If you use NOT, try using parens around the search string you are trying to exclude. I've also seen it make a difference whether you are using a raw search or a datamodel / tstats search. When using !=, make sure to be specifying a field, such as query !="*.arpa". There are plenty of times, I have to monkey around with the order of my syntax, but ultimately, I can get data excluded from search results. Just be careful with your use of wildcards, quotes and make sure that the field names actually exist when using !=

0 Karma