How to extract some sourcename of a report?

[jip31jip31]

hi,
I use this report request but I would like some sourcenames to not appear in the result.
Their name is:

Microsoft-Windows-Sysmon

Microsoft-Windows-TaskScheduler
PowerShell
MacAFee Endpoint Security

Thanks for your help

index="*" sourcetype="wineventlog:*" EventCode=* Type="*" | stats count by SourceName Type

[kmaron]

specify which sourcenames you do not want in the initial search:

index="*" sourcetype="wineventlog:*" EventCode=* Type="*" SourceName!="Microsoft-Windows-Sysmon" SourceName!="Microsoft-Windows-TaskScheduler" SourceName!="PowerShell" SourceName!="MacAFee Endpoint Security" | stats count by SourceName Type

or to simplify it

index="*" sourcetype="wineventlog:*" EventCode=* Type="*" NOT SourceName IN ("Microsoft-Windows-Sysmon" "Microsoft-Windows-TaskScheduler" "PowerShell" "MacAFee Endpoint Security") | stats count by SourceName Type

[kmaron · Accepted solution]

index="" sourcetype="wineventlog:" EventCode= Type="" | stats count by SourceName Type | fields - SourceName

You can remove a field from your result using the fields command and a minus