Elegant way of searching for all events where a field is not in a literal list of values

[bobmorning]

What is the most elegant way of searching for events where a field is not in a list of values?   For example:

index=foo | iplocation foo_src_ip |  search Country IN ("France", "United States")

works great.   

But what if I want all events where the IP was not from those countries (the  inverse answer), like "Canada", "Mexico".

Thanks for any assistance.

Bob

[ITWhisperer · Accepted solution]

Try

index=foo | iplocation foo_src_ip |  search NOT Country IN ("France", "United States")