Anyone else seen this before? I'm building a search, then telling Splunk to NOT or using field!=something and Splunk is straight up ignoring it and showing the field anyway I've tried using quotes, NOT versus != and explicit typing out the value instead of using a wildcard.
If you use NOT, try using parens around the search string you are trying to exclude. I've also seen it make a difference whether you are using a raw search or a datamodel / tstats search. When using !=, make sure to be specifying a field, such as query !="*.arpa". There are plenty of times, I have to monkey around with the order of my syntax, but ultimately, I can get data excluded from search results. Just be careful with your use of wildcards, quotes and make sure that the field names actually exist when using !=