topic Re: How do I exclude multiple specific source-alerts from search results? in Alerting

How do I exclude multiple specific source-alerts from search results?

HenryFitzerald — Mon, 04 Feb 2019 14:16:40 GMT

I have four alerts and wanted to exclude these specific FOUR(ALERT1,ALERT2,ALERT3,ALERT4) from the alert trigger search.

I was expecting this query to work using NOT, but it does not work and ALERT1 & 2 currently appears. Could anyone please assist?

<query>index=universal_alerts_   
         NOT  ( source =ALERT1               AND
                      source =ALERT2              AND         
                      source =ALERT3              AND
                      source =ALERT4              AND
                     )
        | timechart count by source
</query>

This query seems a valid alternative?? But, I am not sure why ????

<query>  
             index=universal_alerts_   
                    ( source! =ALERT1              AND
                      source! =ALERT2              AND         
                      source! =ALERT3              AND
                      source! =ALERT4              AND
                     )
                 |  timechart count by source
</query>

Re: How do I exclude multiple specific source-alerts from search results?

vishaltaneja070 — Tue, 29 Sep 2020 23:08:55 GMT

Hello @HenryFitzerald ,

Re: How do I exclude multiple specific source-alerts from search results?

Vijeta — Mon, 04 Feb 2019 14:44:11 GMT

Try this

<query>  
              index=universal_alerts_   
                   NOT  source IN("ALERT1", "ALERT2","ALERT3","ALERT4")

                  |  timechart count by source
 </query>

Re: How do I exclude multiple specific source-alerts from search results?

kamlesh_vaghela — Mon, 04 Feb 2019 15:34:41 GMT

@HenryFitzerald ,

You can try this also.

 <query>
    index=universal_alerts_ 
    NOT (source="ALERT1" OR source="ALERT2" OR source="ALERT3" OR source="ALERT4") 
| timechart count by source
 <query>

Thanks

Re: How do I exclude multiple specific source-alerts from search results?

woodcock — Mon, 04 Feb 2019 21:19:28 GMT

You are using AND and should be using OR like this:

index=universal_alerts_ AND NOT (source ="ALERT1" OR source ="ALERT2" OR source ="ALERT3" OR source ="ALERT4)
| timechart count by source

Re: How do I exclude multiple specific source-alerts from search results?

HenryFitzerald — Tue, 05 Feb 2019 10:57:11 GMT

Thanks it should include an OR .