Firstly, let me point out that you're trying to resurrect an 8 year old thread. Next time, start a new one with your question - you'll get better chance of reply. Back to your question - if you want to find all events which don't contain the string "abc" _anywhere_ within the raw event, simply search for NOT *abc* Having said that - it's not the best way to search. If you search for something containing wildcard at the beginning of the search term (either as a straight search or a negative search like in our case) splunk has to scan all raw events to verify whether the event matches. It cannot use internal indexes of words to find only a subset of events which matches the condition. Therefore you should, whenever possible, search for fixed strings. And remember that while indexing events splunk splits them into words on whitespaces and punctuators. So "abc" will match both "abc def" as well as "whatever.abc.ding-dong". Wildcards are often overused in splunk search and they might incur huge performance penalty. ... View more