I have the following query :
sourcetype="docker" AppDomain=Eos Level=INFO Message="Eos request calculated" | eval Val_Request_Data_Fetch_RefData=Round((Eos_Request_Data_Fetch_MarketData/1000),1)
Which have 3 host like perf, castle, local.
I want to use the above query bust excluding host like castle and local
sourcetype="docker" AppDomain=Eos Level=INFO Message="Eos request calculated" | eval Val_Request_Data_Fetch_RefData=Round((Eos_Request_Data_Fetch_MarketData/1000),1) | where host NOT like 'castle' AND 'local' ??
Will it work
Try this!
sourcetype="docker" AppDomain=Eos Level=INFO Message="Eos request calculated" NOT (host='castle' OR host='local')
This is also possible.
NOT (host='*castle*' OR host='*local*')
to wildcard NOT, you can do like what @HiroshiSatoh mentioned and go with
sourcetype="docker" AppDomain=Eos Level=INFO Message="Eos request calculated" NOT (host=*castle* OR host=*local* OR host=*perf*)| eval Val_Request_Data_Fetch_RefData=Round((Eos_Request_Data_Fetch_MarketData/1000),1)
which will remove the hosts that contain perf, castle, or local from the base search
or if you need to remove it later on in the search, after doing evals/stats with it, perhaps, using where and like would be like this:
...|where NOT like(host,"%perf%") AND NOT like(host,"%castle%") AND NOT like(host,"%local%")
Try this!
sourcetype="docker" AppDomain=Eos Level=INFO Message="Eos request calculated" NOT (host='castle' OR host='local')
This is also possible.
NOT (host='*castle*' OR host='*local*')
You can also use:
NOT (host IN (*castle*,*local*))
So full query will be something like this:
sourcetype="docker" AppDomain=Eos Level=INFO Message="Eos request calculated" NOT (host IN (*castle*,*local*))