topic NOT like multiple values in Splunk Search https://community.splunk.com/t5/Splunk-Search/NOT-like-multiple-values/m-p/481655#M140403 <P>Looking to exclude certain values for field instance. How can I achieve this? <BR />Propose code (not working)</P> <PRE><CODE>index=abc sourcetype=xyz IncomingMessage | rex field=source "/apps/prod/(?&lt;instance&gt;.*)/logs" | where NOT LIKE instance IN ("foo", "bar") </CODE></PRE> Sun, 07 Jun 2020 22:30:18 GMT rizwan0683 2020-06-07T22:30:18Z NOT like multiple values https://community.splunk.com/t5/Splunk-Search/NOT-like-multiple-values/m-p/481655#M140403 <P>Looking to exclude certain values for field instance. How can I achieve this? <BR />Propose code (not working)</P> <PRE><CODE>index=abc sourcetype=xyz IncomingMessage | rex field=source "/apps/prod/(?&lt;instance&gt;.*)/logs" | where NOT LIKE instance IN ("foo", "bar") </CODE></PRE> Sun, 07 Jun 2020 22:30:18 GMT https://community.splunk.com/t5/Splunk-Search/NOT-like-multiple-values/m-p/481655#M140403 rizwan0683 2020-06-07T22:30:18Z Re: NOT like multiple values https://community.splunk.com/t5/Splunk-Search/NOT-like-multiple-values/m-p/481656#M140404 <P>check reference<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Where">https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Where</A><BR /> <A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval">https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval</A></P> Tue, 21 Apr 2020 21:14:32 GMT https://community.splunk.com/t5/Splunk-Search/NOT-like-multiple-values/m-p/481656#M140404 to4kawa 2020-04-21T21:14:32Z Re: NOT like multiple values https://community.splunk.com/t5/Splunk-Search/NOT-like-multiple-values/m-p/481657#M140405 <P>thanks, this works <BR /> | where NOT LIKE(instance, "%foo%") AND NOT LIKE(instance, "%bar%") </P> Tue, 21 Apr 2020 21:22:45 GMT https://community.splunk.com/t5/Splunk-Search/NOT-like-multiple-values/m-p/481657#M140405 rizwan0683 2020-04-21T21:22:45Z Re: NOT like multiple values https://community.splunk.com/t5/Splunk-Search/NOT-like-multiple-values/m-p/481658#M140406 <P>I see, accept your answers.</P> Tue, 21 Apr 2020 21:46:15 GMT https://community.splunk.com/t5/Splunk-Search/NOT-like-multiple-values/m-p/481658#M140406 to4kawa 2020-04-21T21:46:15Z