Brain must not be working today. This should be a simple one. I am trying to ignore multiple values from a field... This works but I would rather not do it this way.
| search SNumber != 9901
| search SNumber != 9900
| search SNumber != 9712
| search SNumber != 9709
| search SNumber!= 8004
| search SNumber != 8001
| search SNumber != 6666
I tried
|search SNumber !=9901,9900,9712,9709,8004,8001,6666
|search SNumber !=(9901,9900,9712,9709,8004,8001,6666)
|search SNumber NOT (9901,9900,9712,9709,8004,8001,6666)
|where SNumber !=9901 OR 9900 OR 9712 OR 9709 OR 8004 OR 8001 OR 6666
to no avail
Hi,
try some variants like this.
your_inital_search AND NOT (SNumber = 9901 OR SNumber = 9900 OR SNumber = 9712 ... )
or try it with where-command
| where NOT (like(SNumber, "9901") OR like(Snumber, "9900") OR ....)
or
| where NOT (SNumber="9901" OR SNumber="9900" OR ...)
Your variants will not work.
Hi,
try some variants like this.
your_inital_search AND NOT (SNumber = 9901 OR SNumber = 9900 OR SNumber = 9712 ... )
or try it with where-command
| where NOT (like(SNumber, "9901") OR like(Snumber, "9900") OR ....)
or
| where NOT (SNumber="9901" OR SNumber="9900" OR ...)
Your variants will not work.