Exclude search events for a field containing a specific useragent.

[bcherdak]

I am attempting to create a sorted count list of useragents that customers are using to browse my website.

I want to exclude certain results and only show events of unknown agents,bots,vulnerability scanners.

Currently I am using the string

index = UV | where NOT like(ad_UserAgent,"%Mozilla%") OR like(ad_UserAgent,"%Opera%") | stats count by ad_UserAgent | sort - count

Is there something I am doing wrong that is still showing events that contain Mozilla and Opera?

thank you for the assistance.

[dturnbull_splun]

A more straightforward search might be:

index=UV ad_UserAgent!=*Mozilla* ad_UserAgent!=*Opera* | top limit=0 ad_UserAgent

[richgalloway]

Looks like you need some parens. Have you tried ... | where NOT (like(ad_UserAgent,"%Mozilla%") OR like(ad_UserAgent,"%Opera%")) | ... ?