What is the most elegant way of searching for events where a field is not in a list of values? For example:
index=foo | iplocation foo_src_ip | search Country IN ("France", "United States")
works great.
But what if I want all events where the IP was not from those countries (the inverse answer), like "Canada", "Mexico".
Thanks for any assistance.
Bob
Try
index=foo | iplocation foo_src_ip | search NOT Country IN ("France", "United States")
Try
index=foo | iplocation foo_src_ip | search NOT Country IN ("France", "United States")