Hi,
I tried to find out how to exclude tags from tstats search. My search is:
| tstats summariesonly=true allow_old_summaries=true count from datamodel="Network_Resolution"."DNS" where "DNS.message_type"="QUERY" by "DNS.src" | rename "DNS.src" as "src" | where 'count'>100
I want to make custom tag and exclude it from the search. Tag name could be "DNS" from src address.
I can exclude single ip address with this query but i would like to exclude src ip addressess what have tag "DNS"
| tstats summariesonly=true allow_old_summaries=true count from datamodel="Network_Resolution"."DNS" where DNS.src!=8.8.8.8 AND "DNS.message_type"="QUERY" by "DNS.src" | rename "DNS.src" as "src" | where 'count'>100
How should I change the query?
I have already tried to exclude:
"tag::src"!=DNS
"tag::DNS.src"!=DNS
With no results.
