Looking to exclude certain values for field instance. How can I achieve this?
Propose code (not working)
index=abc sourcetype=xyz IncomingMessage
| rex field=source "/apps/prod/(?<instance>.*)/logs"
| where NOT LIKE instance IN ("foo", "bar")
thanks, this works
| where NOT LIKE(instance, "%foo%") AND NOT LIKE(instance, "%bar%")
thanks, this works
| where NOT LIKE(instance, "%foo%") AND NOT LIKE(instance, "%bar%")
I see, accept your answers.