Need to search from a result without a particular value for a field

[uayub]

I have a search defined as

status=deny
The search list the result correctly. From this result there is a field dst which has an IP as its value. How could I further filter my search for the dst to not have a certain IP address?

For eg how could I achieve the result to not list say IP=255.255.255.255

I have tried this and it does not work: status=deny | where (dst not like "255.255.255.255")

The where above cannot take not as an argument. I am trying to filter the result to not have 255.255.255.255

Any help would be apprecaited.

Thanks.

[Ayn]

It's as simple as using boolean operators directly in your base query.

status=deny AND NOT dst="255.255.255.255"

Even if where WOULD have accepted your syntax, it makes for a very inefficient search because what would happen is that the initial search command would retrieve ALL events that have "status=deny" before passing it on to the next command in the search pipeline. By filtering directly in the base search your query becomes much more efficient because only the events you're interested will actually be retrieved from the index.

[uayub]

Thanks a lot Jonuwz and Ayn... You folks ROCK !!!!

[jonuwz]

+1 for explaining why 🙂