I am attempting to create a custom trigger condition for the alert below that will only trigger if the dest_ip does not equal a specific IP.
Currently attempting the trigger alert when custom with: search NOT dest_ip=xxx.xxx.xxx.xxx
and have also tried: search dest_ip!=xxx.xxx.xxx.xxx
and I am still seeing email alerts being sent for alerts in which the destination ip is the one that should be omitted.
When debugging issues like this, one thing you have to check for is multivalue fields. If there are two dest_ip values, then one of them will always NOT match any given value. Also, be sure to put quotes around literals when appropriate.
So, start with finding an exact moment that you have an event that sets off your alert, then run this to see which tests work for you.
I have run the suggestion above and we do see at times multiple entries for dest_ip. I am having trouble understanding the syntax for the custom trigger condition and am having trouble finding much documentation on its use. Are you aware of any documentation that explains the trigger condition more than a few greater than or less than count examples.