Can you help me with a search which only shows results that do not contain a specific value?

[JoshuaJohn]

I want to see devices that do not have a specific value. I am organizing my devices by Mac Address, and I am trying to see the ones that do not have a profile named WifiProfile_X.

I keep getting the ones that do contain this profile, but I need to see the ones that dont.. any ideas?

index=nitro_apps source="DATA" | rex "^[^,\n]*,(?P<OG>[^,]+)[^,\n]*,(?P<MacAddress>[^,]+)(?:[^ \n]* ){4}(?P<Model>[^,]+),(?P<OS>[^,]+),\w+,(?P<Profile>[^,]+),\d+,(?P<Latest_Version>\d+),(?P<Installed_Date>[^,]+)[^,\n]*,(?P<Installed>\w+)"  | search OG=7 AND Model=180 AND Profile NOT "WifiProfile_X"
|stats list(MacAddress), list(Model), dc(MacAddress)

[JoshuaJohn]

It was my regex... figured it out, thanks!

[mstjohn_splunk]

@joshuajohn

i'm glad you figured out the problem for yourself. Would you mind describing how you were able to fix your regex so that future users could learn from your process? Thanks.

[Vijeta]

Hi,

Try using this search-

search OG=7 AND Model=180 AND Profile != "WifiProfile_X"

Thanks

[JoshuaJohn]

Unfortunately no, this gives me every device in that location regardless of each devices settings.

[Vijeta]

Do you want to list count of all distinct Mac address and also list all models and MacAddress by Profile? What does device settings refer to?