I love the tag feature of ServiceNow because you can simply mark any records and thus map search scenarios that would not be possible with normal search filters.

In most cases, it is enough to search for specific tags. But what if you search the other way round, i.e. find all records that do NOT have a certain tag?

With the OOTB possibilities of the filters one does not come here further, however there is a trick.

	We start at the list of all Instance Scan checks with an empty filter and a result list of 621 records.
	The next step is the most important: You have to select two times the Tags criteria and combine them with an OR condition: one time with an empty value and one time with the Tag that should be excluded later.
	The result set is the same as before, and the filter breadcrumbs reflect the configured search. The next step is to reverse the search query.
	For that step examine the query part of the URL parameters (sysparm_query). The interesting part here is the double URL-encoded presentation of an equals sign: %253D Right before that expression, insert an exclamation mark which represents the negation of the following expression:

ORsys_tags.a81628fc97266110b05bb08fe153afe4*!* %253Da81628f

After hitting ENTER the search result should only list all records without the excluded tag (now 593 instead of 68 records before).

If you right-click on the filter breadcrumbs and then select "Copy query" you will get the correct representation of the query for the further use in your scripts.