I want to exclude the INFO log level in one of my searches. How would i do a "not" condition in the following:
source=yyy| timechart count by LogLevel limit=10
I tried "where LogLevel NOT(INFO) and it did not filter out INFO entries in the chart.
thanks,
Y
You'd do this:
source=yyy NOT LogLevel=INFO | timechart count by LogLevel limit=10