I appologize if this is already answered. I'm having trouble figuring out how to even search for it.
I am trying to search through logs that have two fields: user and software version. I am trying to find a way to search through this data and return any user who has not upgraded their software so I would like to be able to return a list of all users who have never matched software version x but have matches other versions. How would I search for that?
| stats latest(version) by software host
Perhaps index=foo user=* softwareVersion!=x | table user softwareVersion
?