"NOT TERM" removes results

[landen99]

When using NOT TERM, please keep in mind the following bug (see the answer for the workaround):

index=myindex NOT TERM(b=c)

will yield zero results if all the events contain “a_b=c” like this:

foo a_b=c b=d bar

The problem appears to exist only for normal searches using NOT on TERM where “b=c” exists in other places like “a_b=c”. It does not appear when using tstats. It seems to be a post-search filter.

[mhoogcarspel_sp]

That's not a bug I think, it's just "b=c" is not a term in the lexicon

fake results:

| makeresults 
| eval _raw="foo a_b=c b=d bar" 
| collect

can find it:

index=summary NOT TERM(b=c)

can't find it:

index=summary NOT TERM(*b=c)

validate:

| walklex index=summary 
| table * 
| search term="*b=c*"

tested on 8.0.1

("_" is a minor segmenter)
https://docs.splunk.com/Documentation/Splunk/8.0.0/Admin/Segmentersconf

https://docs.splunk.com/Documentation/Splunk/8.0.0/Search/UseCASEandTERMtomatchphrases

TERM: Match whatever is inside the
parentheses as a single term in the
index, even if it contains characters
that are usually recognized as minor
segmenters, such as periods or
underscores.
...

The TERM directive is useful when you
are searching for a term:

That contains minor breakers
Is bound by major breakers, such as spaces or commas Does not contain
major breakers

and your term isn't bound by major breakers, but a major (the space) and a minor one (the "_")

[woodcock]

Also be aware of this:
https://docs.splunk.com/Documentation/Splunk/latest/Search/NOTexpressions

[landen99 · Accepted solution]

The work-around appears to be to explicitly include “TERM(a_b=c)” like this:
index=myindex TERM(a_b=c) NOT TERM(b=c)

[mhoogcarspel_sp]

Don't think this is accurate, have a look at my answer below

[landen99]

It is accurate. Martin Mueller has verified it too.