How to exclude all days of one month from a time range?

[chinmay25]

Here is the part of the search that I am working on, and trying to exclude certain numbers of days. However, where Date != 20190401 removes only April 1st from the result. I need to exclude all the days of April.

index:

| where Date != "20190401"
| stats sum(claim_nums) as "Total Claims" by Date
| appendpipe [ stats avg("Total Claims") as ClaimAvg 
| eval ClaimAvg = round(ClaimAvg,2) | eval "Total Claims" = "TOTAL AVG CLAIMS ".ClaimAvg 
| fields - ClaimAvg]
| sort - DATE

I tried adding multiple dates in the where command, but it doesn't work.

[DalJeanis · Accepted solution]

I'll bet you tried

| where Date != "20190401" OR  Date != "20190402" 

Every record will always be either not the first value or not the second value. You need to use AND to make that kind of code work.

However, you can also do something like this to test them all at the same time, assuming Date is a text field.

| where ( substr(Date,1,6)!="201904" ) 

[chinmay25]

Thanks. Yes I tried the first option but it didn't work. The second option works perfect. Thanks.