Hi, Can I write my search as:
index=idx1 host != (a,b,c) | stats count by host
The thing is I want to filter some of the hosts in the count.
You can do this:
index="idx1" AND NOT host IN("a","b","c")
| stats count by host
View solution in original post