Not Like function !Like

[navdeep1568]

I am trying to search for a server which is named differently than all the others in our network. Commonly servers are named with Location followed by 4 digits and then some string in the end (Eg: Flra2209php_ua).

If one of the machines is not following this naming convention, how do I search for it? I was hoping there would be a "not like" function which might help with this?

[vnravikumar]

Hi @navdeep1568

Try this

| makeresults 
| eval server="Flra2209php_ua,Flra2209" 
| makemv delim="," server 
| mvexpand server 
| where NOT match(server,"\w+\d{4}\S+")

[richgalloway]

Try regex. Use | regex Name!="\w{4]\d{4}.*" to exclude events where the "Name" field doesn't contain four alphanumerics, then four digits, and then any text.