Best practice on false positives

[FRoth]

What do you regards as the best practice to filter false positives from all views.

Currently I add all false positives to a search macro like this:

Macro: fps

Expression: ( "user1234" OR "admin123" )



Then I use the " NOT `fps`" string in the search to filter the false positives from the view. Would you regard this as a good idea. I find it quite handy to change the single statement that is included in all searches and panels. A problem I have is that the expression grew pretty big and some of the searches from dashboard panels fail because of an over long URL query.

Would you prefer using "tags" or something else?

[dart]

I like to use tags for this use case. Tags can be applied to any field, or can be applied to an eventtype for a more complex exclusion.

[FRoth]

Can they be applied to the _raw field as well?

[jtrucks]

I consider this a problem to be tuned on a per search basis. Generally I try to avoid doing the NOT this NOT that approach, but we all have to do it at times. I find it generally better to tune each search because there might be a case where something is a false positive for one search but not another search. In addition, as you noted, there becomes a management overhead and possible performance issue with it growing too big.

You could make a saved search of fps that included all the other eventtypes, tags, macros, or other saved searches you create to mark false positives, but having a single definition used in too many places might bite you in the future.

So, specifically I try to change my searches to be more specific in ways that won't find false positives and don't require negating a bunch of stuff manually. This is easier done with more complex profiling rather than simpler pattern matching searches, of course.