Unable to Seam Together Tstats and "!=" Operator

[LionelHutz]

Hello Hello,

Trying to make this search work:

| tstats allow_old_summaries=true dc(Malware_Attacks.signature) as "infection_count" from datamodel=Malware where ((Malware_Attacks.file_path!="C:\ProgramData\Adobe*") nodename=Malware_Attacks) by "Malware_Attacks.dest", "Malware_Attacks.file_path"
| rename "Malware_Attacks.dest" as "dest"
| where 'infection_count'>1

(The goal being to exclude any event which has a file path containing "C:\ProgramData\Adobe\*").

I'm open to the NOT operator instead of !=.  I've tried a handful of different ways of wording this query, but can't get it to produce what I want.

Thank you to whoever can shed light on this!

[LionelHutz]

I figured it out, here is the answer in case anyone ever needs it!

| tstats allow_old_summaries=true dc(Malware_Attacks.signature) as "infection_count" FROM datamodel=Malware WHERE (nodename=Malware_Attacks "Malware_Attacks.file_path"!="**Adobe**") by "Malware_Attacks.dest", "Malware_Attacks.file_path"
| rename "Malware_Attacks.dest" as "dest"
| where 'infection_count'>1