https://community.splunk.com/t5/Splunk-Search/Use-of-NOT-operator/m-p/60768#M180143 <P>Awesome! That did it!<BR /> Thanks!</P> Wed, 11 Sep 2013 20:00:03 GMT lbogle 2013-09-11T20:00:03Z https://community.splunk.com/t5/Splunk-Search/Use-of-NOT-operator/m-p/60766#M180141 <P>Hello Splunkers,<BR /> I'm trying to run a search against some logs that include a wild carded hostname, two error messages but exclude two IP addresses. I have the first parts down but excluding the IP addresses isn't quite working out. What am I doing wrong here? (IP's modified for the post)</P> <PRE><CODE>host="*-contlr-wl.Domain.COM" error OR fail* admin NOT (123.123.123.123 AND 456.456.456.456) </CODE></PRE> <P>So I'm getting all reports from contlr-wl machines.<BR /> I'm getting all the messages that have either error OR fail* in them <BR /> But the two IP addresses are still showing up. How do I exclude those from my search?<BR /> Thanks everyone.</P> Wed, 11 Sep 2013 19:29:59 GMT https://community.splunk.com/t5/Splunk-Search/Use-of-NOT-operator/m-p/60766#M180141 lbogle 2013-09-11T19:29:59Z https://community.splunk.com/t5/Splunk-Search/Use-of-NOT-operator/m-p/60767#M180142 <P>You are telling the search engine to only exclude the IPs if they both appear in the same event.</P> <P>Try</P> <P>NOT "*123.123.123.123*" NOT "*456.456.456.456*"</P> Wed, 11 Sep 2013 19:33:26 GMT https://community.splunk.com/t5/Splunk-Search/Use-of-NOT-operator/m-p/60767#M180142 lukejadamec 2013-09-11T19:33:26Z https://community.splunk.com/t5/Splunk-Search/Use-of-NOT-operator/m-p/60768#M180143 <P>Awesome! That did it!<BR /> Thanks!</P> Wed, 11 Sep 2013 20:00:03 GMT https://community.splunk.com/t5/Splunk-Search/Use-of-NOT-operator/m-p/60768#M180143 lbogle 2013-09-11T20:00:03Z