Hello,
I'm trying to exclude the results that I obtain from this search. Essentially, this yields all bots hitting my web server. Now I'm trying to exclude this results so it shows me, hopefully, all human hits. I've been trying to do | stats count (eval(NOT match . . . , but I cannot for the life of me figure it out. Thanks!
sourcetype="access_combined" host="www7*"
| eval usersession=clientip + "_" + useragent
| sort usersession, _time | delta _time as visit_pause p=1
| streamstats current=f window=1 global=f last(usersession) as previous_usersession
| eval visit_pause=if(usersession==previous_usersession, visit_pause, -1) | search visit_pause!=-1
