How do I exclude multiple specific source-alerts from search results?

[HenryFitzerald]

I have four alerts and wanted to exclude these specific FOUR(ALERT1,ALERT2,ALERT3,ALERT4) from the alert trigger search.

I was expecting this query to work using NOT, but it does not work and ALERT1 & 2 currently appears. Could anyone please assist?

<query>index=universal_alerts_   
         NOT  ( source =ALERT1               AND
                      source =ALERT2              AND         
                      source =ALERT3              AND
                      source =ALERT4              AND
                     )
        | timechart count by source
</query>

This query seems a valid alternative?? But, I am not sure why ????

<query>  
             index=universal_alerts_   
                    ( source! =ALERT1              AND
                      source! =ALERT2              AND         
                      source! =ALERT3              AND
                      source! =ALERT4              AND
                     )
                 |  timechart count by source
</query>  

[woodcock · Accepted solution]

You are using AND and should be using OR like this:

index=universal_alerts_ AND NOT (source ="ALERT1" OR source ="ALERT2" OR source ="ALERT3" OR source ="ALERT4)
| timechart count by source

[HenryFitzerald]

Thanks it should include an OR .

[kamlesh_vaghela]

@HenryFitzerald ,

You can try this also.

 <query>
    index=universal_alerts_ 
    NOT (source="ALERT1" OR source="ALERT2" OR source="ALERT3" OR source="ALERT4") 
| timechart count by source
 <query>

Thanks

[Vijeta]

Try this

<query>  
              index=universal_alerts_   
                   NOT  source IN("ALERT1", "ALERT2","ALERT3","ALERT4")

                  |  timechart count by source
 </query>  

[vishaltaneja070]

Hello @HenryFitzerald ,

try something like this:
index=universal_alerts_ NOT
[| makeresults | eval source= "ALERT1;ALERT2;ALERT3;ALERT4;" | eval source=split(source,";") | mvexpand source | fields - _time] | timechart count by source