How to edit this search to exclude some servers from the metadata?

[kirankotla]

| metadata   index=Test_app  type=hosts | eval age = now()-lastTime | where age > (60) | sort age d | convert ctime(lastTime)  | fields age,host,lastTime

Please provide query for excluding a few servers from this metadata.

[sjohnson_splunk]

What do you mean by servers? The splunk indexers that are returning the data or the actual host names returned by the metadata?

If you want to filter by hosts, I like to use a regex statement since often host names have some pattern that can be used (i.e. wxxx for windows, xxxpxxx - production, etc.) This is easy with regex:

| regex host!="^w"
or
| regex host!="np|dev"

Just remember that regex is case sensitive, so you may need to use "(?i)np|dev" to make it case insensitive.

[niketn]

You can filter using search command. Ideally you should include the hosts you need rather than excluding the hosts you don't need. You can use AND and OR for adding a list of hosts. Following example will exclude all servers starting with abc like abc01, abc02 etc.

| metadata index=Test_app type=hosts 
| search host!="abc*"
| eval age = now()-lastTime 
| where age > (60) 
| sort age d 
| convert ctime(lastTime)
| fields age,host,lastTime

Following will not include servers abc, def, ghi. Like stated earlier, performance wise, it is better to include required fields values rather than excluding the values not required.

| metadata <Your Base Search>
| search host!="abc" AND host!="def" AND host!="ghi"
| <your remaining search>