How do I not show the value I do not want?

[mplungjan]

For an apache access log file with an extra field I have created a field extraction myfield - it works great.

I then want to extract all rows where this field is not equal to "-"

So I make a search

myfield !="-" | top limit=10000 myfield

And I still see "-" in the table

I even tried

myfield !="-" | top limit=10000 myfield | where myfield != "-"

Nope - still there. Since the vast majority of record have "-", all the rest have tiny colums.

What am I doing wrong and where in the documentation does it tell me what I had to do.

It is a bit like the useother=0

[mplungjan · Accepted solution]

Solved!

The extract included the quotes.

myfield!="\"-\""

works!

[mplungjan]

No difference. See update

[hRun]

myfield may contain a blank infront of or after the "-", have you tried myfield!="- ", myfield!=" -" or myfield!="*-*", etc.

[gfuente]

Have you tried this?

search NOT myfield="-" |....

Regards

[Ayn]

In that case all your events have a "myfield" with the value "-". Either that, or you're issuing the search incorrectly. Note that you should not be including the actual "search" word if this is the first command in the search pipeline.

[mplungjan]

No results at all