Removing source rows based on field values.

[richtate]

I have a index with thousands of operating systems (OS).  I want to remove unwanted operating systems (OS) from my report using wild cards as many of the unwanted share the same value as part of the OS.

Here is what I'm trying to do:

earliest=-15d@d index="asset" sourcetype="Tenable:SecurityCenter:Asset"
WHERE operating_system NOT "[APC*" OR "[AIX*"
| stats count by operating_system

I want to remove OS that have APC or AIX ( and others not listed) from the query.  But I can't use a wildcard which would mean hundreds of entries just for APC and all the versions I want to exclude.  I've tried NOT IN, NOT LIKE, != and more but either nothing is returned or what I want filtered out is not filtered and all events are returned.  Suggestions?

[ITWhisperer]

| regex operating_system!="^\[(APC|AIX)"

[richtate]

I gave that a try and still getting those OS returned:

[ITWhisperer · Accepted solution]

These operating systems don't have the leading [ which you had in your original post - try this instead

| regex operating_system!="(APC|AIX)"