I have an app that can show source by country
Example:
Country=China
In SPL how would I format this if I wanted to Search like all possible values for Country except like USA?
try Country!=*USA*
if there is a wildcard, not that I can imagine a wildcard in the country.
otherwise, Country!="USA"
or NOT Country="USA"
should do the trick
it should be noted that when using !=
, any event that does not include Country will also be excluded whereas when using NOT
, events where Country doesn't exist will come back as well. So if Country is in 80% of your events and you only want to exclude "USA" but want to include events without Country, use NOT Country="USA"
. If you want to exclude both null country values as well as USA, use Country!="USA"
try Country!=*USA*
if there is a wildcard, not that I can imagine a wildcard in the country.
otherwise, Country!="USA"
or NOT Country="USA"
should do the trick
it should be noted that when using !=
, any event that does not include Country will also be excluded whereas when using NOT
, events where Country doesn't exist will come back as well. So if Country is in 80% of your events and you only want to exclude "USA" but want to include events without Country, use NOT Country="USA"
. If you want to exclude both null country values as well as USA, use Country!="USA"