When you are not using any filter, we are checking the presence.

The Snap displays the records that start with the word user in the cn field. Here, you can see a single record.

not filter

Configure the LDAP Search Snap with a not filter.

The Snap displays all the records that do not start with the word user in the cn attribute.

and not nested filter

Configure the LDAP Search Snap with a nested filter.

The Snap displays all the records that do not start with adduser but start with the word user in the cn field. The Snap displays only one such record.