Filter events with specific text

[procha]

I've already indexed a bunch of syslog data. However, when I search I'd like to be able to filter out certain events that have the same text in them. How can I do this? For example I want to filter out "Failed to ready header on stream TCP" from my search results (see example text below). Thanks!

Example:

Aug 1 10:17:56 10.112.101.103 Aug 1 14:17:57 Hostd: [2011-08-01 14:17:57.724 54B16B90 error 'App'] Failed to read header on stream TCP(local=127.0.0.1:62968, peer=127.0.0.1:0): N7Vmacore15SystemExceptionE(Connection reset by peer)

[RicoSuave · Accepted solution]

add the following to your search:

NOT "Failed to ready header on stream TCP"

Or if that message is already being extracted in a field,

NOT myfield="Failed to ready header on stream TCP"