FIELDNAME regex rex

[splunkmeuser]

sourcetype="apache-access" | rex "(?i)\(.*?; (?P\w+)(?=/)" | top 100 FIELDNAME

i'm using the above to get information about bots.

how exactly can i modify the above to exclude certain bots????

i've tried:

sourcetype="apache-access" | rex "(?i)\(.*?; (?P\w+)(?=/)" | top 100 FIELDNAME | where FIELDNAME!=Trident

can someone please help me modify the above so it does exactly what i need. i just need to be able to exclude certain bots.

[lukejadamec · Accepted solution]

sourcetype="apache-access" | rex "(?i)(.*?; (?P\w+)(?=/)" |search NOT fieldname="bot1" NOT fieldname="bot2" NOT fieldname="bot3" |top 100 fieldname