https://community.splunk.com/t5/Splunk-Search/Search-to-filter-data/m-p/474008#M133358 <P>Hi, Can I write my search as:</P> <PRE><CODE>index=idx1 host != (a,b,c) | stats count by host </CODE></PRE> <P>The thing is I want to filter some of the hosts in the count.</P> Thu, 31 Oct 2019 20:00:34 GMT raghu0463 2019-10-31T20:00:34Z https://community.splunk.com/t5/Splunk-Search/Search-to-filter-data/m-p/474008#M133358 <P>Hi, Can I write my search as:</P> <PRE><CODE>index=idx1 host != (a,b,c) | stats count by host </CODE></PRE> <P>The thing is I want to filter some of the hosts in the count.</P> Thu, 31 Oct 2019 20:00:34 GMT https://community.splunk.com/t5/Splunk-Search/Search-to-filter-data/m-p/474008#M133358 raghu0463 2019-10-31T20:00:34Z https://community.splunk.com/t5/Splunk-Search/Search-to-filter-data/m-p/474009#M133359 <P>You can do this:</P> <PRE><CODE>index="idx1" AND NOT host IN("a","b","c") | stats count by host </CODE></PRE> Thu, 31 Oct 2019 20:53:56 GMT https://community.splunk.com/t5/Splunk-Search/Search-to-filter-data/m-p/474009#M133359 woodcock 2019-10-31T20:53:56Z