topic Re: Exclude search events for a field containing a specific useragent. in Splunk Search https://community.splunk.com/t5/Splunk-Search/Exclude-search-events-for-a-field-containing-a-specific/m-p/243128#M72381 <P>A more straightforward search might be:</P> <PRE><CODE>index=UV ad_UserAgent!=*Mozilla* ad_UserAgent!=*Opera* | top limit=0 ad_UserAgent </CODE></PRE> Mon, 04 Jul 2016 07:20:07 GMT dturnbull_splun 2016-07-04T07:20:07Z Exclude search events for a field containing a specific useragent. https://community.splunk.com/t5/Splunk-Search/Exclude-search-events-for-a-field-containing-a-specific/m-p/243126#M72379 <P>I am attempting to create a sorted count list of useragents that customers are using to browse my website.</P> <P>I want to exclude certain results and only show events of unknown agents,bots,vulnerability scanners.</P> <P>Currently I am using the string</P> <P><STRONG>index = UV | where NOT like(ad_UserAgent,"%Mozilla%") OR like(ad_UserAgent,"%Opera%") | stats count by ad_UserAgent | sort - count</STRONG></P> <P>Is there something I am doing wrong that is still showing events that contain Mozilla and Opera?</P> <P>thank you for the assistance.</P> Tue, 29 Sep 2020 10:07:59 GMT https://community.splunk.com/t5/Splunk-Search/Exclude-search-events-for-a-field-containing-a-specific/m-p/243126#M72379 bcherdak 2020-09-29T10:07:59Z Re: Exclude search events for a field containing a specific useragent. https://community.splunk.com/t5/Splunk-Search/Exclude-search-events-for-a-field-containing-a-specific/m-p/243127#M72380 <P>Looks like you need some parens. Have you tried <CODE>... | where NOT (like(ad_UserAgent,"%Mozilla%") OR like(ad_UserAgent,"%Opera%")) | ...</CODE> ?</P> Sun, 03 Jul 2016 21:37:56 GMT https://community.splunk.com/t5/Splunk-Search/Exclude-search-events-for-a-field-containing-a-specific/m-p/243127#M72380 richgalloway 2016-07-03T21:37:56Z Re: Exclude search events for a field containing a specific useragent. https://community.splunk.com/t5/Splunk-Search/Exclude-search-events-for-a-field-containing-a-specific/m-p/243128#M72381 <P>A more straightforward search might be:</P> <PRE><CODE>index=UV ad_UserAgent!=*Mozilla* ad_UserAgent!=*Opera* | top limit=0 ad_UserAgent </CODE></PRE> Mon, 04 Jul 2016 07:20:07 GMT https://community.splunk.com/t5/Splunk-Search/Exclude-search-events-for-a-field-containing-a-specific/m-p/243128#M72381 dturnbull_splun 2016-07-04T07:20:07Z