If I want to remove an IP address and do a wildcard search, are there any search filter priorities?

[dxw350]

if I want to remove one IP address and then do a wildcard search, would that wildcard host IP search override the removal I did first? Example:

sourcetype=linux host_ip!=192.168.1.4 host_ip=*|table host_ip

[horsefez]

Hi dxw350,

no it would not override the removal of the ip address.
You could also first write
sourcetype=linux host_ip=* host_ip!=192.168.1.4 |table host_ip

it wouldn't chance anything.

[somesoni2]

The search conditions are by joined by default logical operator of 'AND' , so your wildcard filter will still be applicable.

[somesoni2]

If you're including host_ip=* only to get events which non-null value of host_ip, then it's not required as host_ip!=192.168.1.4 will eliminate any event which has host_ip=null. (if you use NOT host_ip=192.168.1.4 then it'll return events with host_ip=null, if any.