Nevermind.. Known issue
https://docs.splunk.com/Documentation/Splunk/8.0.0/ReleaseNotes/KnownIssues
2019-11-11 SPL-179357, SPL-179700 Negated subnet CIDR filter doesn't work in search.
Workaround:
Workaround:
limits.conf: [search] use_search_evaluator_v2=false
Examples searches that don't filter out values: index=_internal (NOT clientip=127.0.0.0/8) | stats count BY clientip
index=_internal (clientip!=127.0.0.0/8) | stats count BY clientip
index=_internal | stats count BY clientip | search (clientip!=127.0.0.0/8) | stats sum(count) BY clientip | noop search_optimization=false
Filtering with | where is OK: index=_internal | where NOT cidrmatch("127.0.0.0/8", clientip) | stats count BY clientip
... View more