How to exclude particular values?

[karthi2809]

Hi All,

How to exclude particular values of fields in this query.In my scenario if message having "file not found" so i dont want to show the transactions. below is the query i tried to exclude.

index=mulesoft environment=*   applicationName IN ("processor","api")|where message!="No files found for*"
| stats values(content.InterfaceName) as InterfaceName  values(content.Error) as error values(message) as message values(priority) as  priority min(timestamp) AS Logon_Time, max(timestamp) AS Logoff_Time BY  applicationName,correlationId
| table  Status InterfaceName applicationName Timestamp "Total Elapsed Time"  FileList "SuccessFile/FailureFile" Response  correlationId 
| search  InterfaceName IN ("Test")
And i tried 
| search NOT message IN ("No files found for*")

[richgalloway]

The where command does not handle wildcards.  Instead, use the search command.

The values function produces multi-value fields, which require special handling.

Try  this query.

index=mulesoft environment=* applicationName IN ("processor","api") message!="No files found for*"
| stats values(content.InterfaceName) as InterfaceName  values(content.Error) as error values(message) as message values(priority) as  priority min(timestamp) AS Logon_Time, max(timestamp) AS Logoff_Time BY  applicationName,correlationId
| where isnotnull(mvfind(InterfaceName, "Test"))
| table Status InterfaceName applicationName Timestamp "Total Elapsed Time" FileList "SuccessFile/FailureFile" Response correlationId

[karthi2809]

Actually i am using multiple values in interfacename.And mvfind is not for interfacename .

| search InterfaceName IN (
"ABC",
"ABCD",
"COP")

[richgalloway]

I don't understand what is meant by "mvfind is not for interfacename".  The mvfind function can be used with any multi-value field (InterfaceName is multi-valued since it is created by the values function).

The mvfind function can be used with multiple values in a regular expression.

| where isnotnull(mvfind(InterfaceName("ABC|ABCD|COP"))

[karthi2809]

I just want to exclude the message contains "No files found" .If the keywords contains No files found .We dont to want to show the particular transactions.Saerch command which is used in last for the values from dropdown from dashboard values .So i used search interfacename in last.

[richgalloway]

The "no file found" message is excluded in the base search.

index=mulesoft environment=* applicationName IN ("processor","api") message!="No files found for*"