https://community.splunk.com/t5/Splunk-Search/FIELDNAME-regex-rex/m-p/22770#M177430 <P>sourcetype="apache-access" | rex "(?i)(.*?; (?P<FIELDNAME>\w+)(?=/)" |search NOT fieldname="bot1" NOT fieldname="bot2" NOT fieldname="bot3" |top 100 fieldname</FIELDNAME></P> Thu, 01 Aug 2013 21:08:57 GMT lukejadamec 2013-08-01T21:08:57Z https://community.splunk.com/t5/Splunk-Search/FIELDNAME-regex-rex/m-p/22769#M177429 <P>sourcetype="apache-access" | rex "(?i)\(.*?; (?P<FIELDNAME>\w+)(?=/)" | top 100 FIELDNAME</FIELDNAME></P> <P>i'm using the above to get information about bots.</P> <P>how exactly can i modify the above to exclude certain bots????</P> <P>i've tried:</P> <P>sourcetype="apache-access" | rex "(?i)\(.*?; (?P<FIELDNAME>\w+)(?=/)" | top 100 FIELDNAME | where FIELDNAME!=Trident</FIELDNAME></P> <P>can someone please help me modify the above so it does exactly what i need. i just need to be able to exclude certain bots.</P> Thu, 01 Aug 2013 21:00:39 GMT https://community.splunk.com/t5/Splunk-Search/FIELDNAME-regex-rex/m-p/22769#M177429 splunkmeuser 2013-08-01T21:00:39Z https://community.splunk.com/t5/Splunk-Search/FIELDNAME-regex-rex/m-p/22770#M177430 <P>sourcetype="apache-access" | rex "(?i)(.*?; (?P<FIELDNAME>\w+)(?=/)" |search NOT fieldname="bot1" NOT fieldname="bot2" NOT fieldname="bot3" |top 100 fieldname</FIELDNAME></P> Thu, 01 Aug 2013 21:08:57 GMT https://community.splunk.com/t5/Splunk-Search/FIELDNAME-regex-rex/m-p/22770#M177430 lukejadamec 2013-08-01T21:08:57Z