Excluding one user name from search

[robK123]

I have this search:

(index=infrastructure-os OR index=main) sudo "incorrect password attempt*" |rex field=_raw "sudo:[^a-z]+(?[^ ]+) : (?[0-9]+) incorrect"|stats sum(failures) by user, host

But I am unsure how to exclude one user called addmm from the results as I do not want to see that one.

Thanks,

[jangid]

try
NOT user="addmm"

[robK123]

That worked perfectly thank you!

[jonuwz]

There's 2 ways to filter out the user.
append either :

| search NOT user="addm"

or

| where user!="addm"

[robK123]

I tried:

(index=infrastructure-os OR index=main) sudo "incorrect password attempt*" |rex field=_raw "sudo:[^a-z]+(?[^ ]+) : (?[0-9]+) incorrect"|stats sum(failures) by user, host NOT user="addm"

but get the following error when I try:

Error in 'stats' command: The argument 'user=addm' is invalid.