Removing a Pattern from the search result

[jaiarchi]

I am searching for a string "xyz" that would result in all actionsteps (with counts) that has "xyz" in it, However I want to remove any string that ends with xyz_I or xyz_S.

Would someone be able to help me on this please.

[woodcock]

Show us the sample events and indicate the ones to keep and the ones not to keep (calling out field names/values).

[gcusello]

HI jaiarchi,
If I correctly understood: do you want to have all events where there is the string xyz but not the ones where there are xyz_I or xyz_S?
if this is your requirement you have to insert in your search:

your_search "xyz" NOT ("xyz_I" OR "xyz_S") | ...

Bye.
Giuseppe

[inventsekar]

Hi Jaiarchi, some more details needed.. what is ur current search query, some sample log lines..

maybe try this one -
Index=indexName xyz NOT (xyz_I OR xyz_S)