Don't show a result where the src_ip is X and dest_ip is Y
index=test host=test source=test conn_state=sf | eval src_ip=x and
I was trying to do it with an AND and it kept crushing !
Your suggestion helped ! Thank you!
index=test host=test source=test conn_state=sf | where src_ip!=x OR dest_ip!=y
