topic Re: Exclusion using NOT to exclude values in Dashboards & Visualizations

Exclusion using NOT to exclude values

secure — Tue, 08 Apr 2025 10:04:29 GMT

i have a query where im generating a table with columns

ostype ,osversion and status i need to exclude anything below version 12 for solaris and suse im using the below command and it works but this is not efficient way

| search state="Installed"
| search NOT( os_type="solaris" AND os_version <12)
| search NOT( os_type="*suse*" AND os_version <12)

i was trying to use the below command

| search state="Installed" NOT (( os_type="solaris" AND os_version <12) OR ( os_type="*suse*" AND os_version <12))

and its not working

any suggestions

Re: Exclusion using NOT to exclude values

gcusello — Tue, 08 Apr 2025 10:32:40 GMT

Hi @secure ,

are you sure about the field names? you used two different names for each of them (ostype and OS_type) but maybe it's a mistyping.

Anyway, che ck the field names.

Then check the value of os_version, if you use the "<" char, it must be numeric.

Ciao.

Giuseppe

Re: Exclusion using NOT to exclude values

ITWhisperer — Tue, 08 Apr 2025 12:22:16 GMT

| search os_version>=12 OR NOT (os_type="solaris" OR os_type="suse")

Re: Exclusion using NOT to exclude values

livehybrid — Tue, 08 Apr 2025 12:48:25 GMT

Hi @secure

You could try the following which I think should do what you need?

| where NOT (os_type="solaris" OR like(os_type,"%suse%")) OR os_version>=12

The match is used due to the wildcards, so in this where statement we are excluding solaris/*suse* unless the os_version is greater/equal to 12 (Which is functionally the same as excluding less than version 12).

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing