Can someone help me modify the Top Infections search? It is using tstats and a datamodel. I'm trying to exclude results where signature=Tracking Cookies, but usual exclusion methods aren't working with tstats and datamodel. The dashboard search is below.
| tstats `summariesonly` dc(Malware_Attacks.dest) as dest_count from datamodel=Malware where * by Malware_Attacks.signature | `drop_dm_object_name("Malware_Attacks")` | sort 10 - dest_count
This search results in a chart with the signature name in one column and dest_count in the next column. I would like to exclude results that match on signature that equals "Tracking Cookies".