Archive
Highlighted

I need to exclude eventID 1058 but only when the host is ServerA or ServerB

New Member

I need to exclude eventID 1058 but only when the host is ServerA or ServerB if its ServerC then I still want to see the event.

I tried NOT (EventID=1058 AND Server=ServerA OR Server=ServerB)

But this is not working as desired.

0 Karma
Highlighted

Re: I need to exclude eventID 1058 but only when the host is ServerA or ServerB

Communicator

I tried this with some of my data and this may be a solution for you. The AND, I believe is implied so not needed (notice the parens):

  • sourcetype= NOT EventID=1058 AND (Server=ServerA OR Server=ServerB)

Hope this helps!

0 Karma