You may want to look into the differences between the "!=" and NOT (XXX) searches. There are some intrinsic differences, and its probably why you are seeing some oddities.. As Lisa says, your search is inefficient... I would recommend adjusting.. index=myindex NOT (source="WinEventLog:Application" OR source="WinEventLog:Security" OR source="WinEventLog:Setup") Here is some more reading on similar topics: https://answers.splunk.com/answers/43228/use-of-not-vs.html http://docs.splunk.com/Documentation/Splunk/6.4.0/Search/Usethesearchcommand#Difference_between_NOT_and_.21.3D ... View more

You are welcome! I must admit I pulled most of those steps right out of their own documentation - they even include screenshots. Though Splunk is an awesome product that does wonderful things, I think what really sets it apart is the quality of the documentation and the community that surrounds it. Stop back if you have more questions! ... View more