How to exclude a list of rex fields, then show a stat?

[pwongcha]

How to exclude a list of rex fields, then show a stat?

Why does PSAPPSRV and GUEST still show up in the result? How do I exclude them?

sourcetype="psoftapp-appsrv" host="csappprd*" 
earliest=10/03/2016:09:00:0 latest=10/03/2016:11:00:0  
NOT (userID=PSAPPSRV OR userID=GUEST )
| rex field=_raw "GetCertificate\]\(3\) Returning context. ID=(?[^,]*)" 
| bucket _time span=1h
| top limit=2 userID by host, _time 

[somesoni2 · Accepted solution]

Though the captured name in the rex command got truncated, I'm assuming it was UserID. So, the field didn't exist in the base search (where you added filter NOT (userID=PSAPPSRV OR userID=GUEST ) ), hence the filter never took place. In fact if the NOT operator was not there, you would have 0 results. You should move the filter after the rex comand when its available. Like this

sourcetype="psoftapp-appsrv" host="csappprd*" 
 earliest=10/03/2016:09:00:0 latest=10/03/2016:11:00:0  
 | rex field=_raw "GetCertificate\]\(3\) Returning context. ID=(?<userID[^,]*)"
| search  NOT (userID=PSAPPSRV OR userID=GUEST ) 
 | bucket _time span=1h
 | top limit=2 userID by host, _time 

[pwongcha]

move the filter after the rex command!!! that works. Thank you verymuch