i have to exclude particular host from this query?

[karthi2809]

| metadata type=hosts index=xx_prod| eval age = now() - recentTime | eval status= case(age < 1800,"Running",age > 1800,"DOWN") | convert ctime(recentTime) AS LastActiveOn
| eval age=tostring(age,"duration") | eval host = upper(host)
| table host age LastActiveOn status
| rename host as "Forwarder Name", age as "Last Heartbeat(min)",LastActiveOn as "Last Active On",status as Status

[Ravan]

Not sure if understand the question properly , but the the usual search NOT will work right ..?

| metadata type=hosts index=xx_prod| search NOT (host=host1 OR host=host2) |eval age = now() - recentTime | eval status= case(age < 1800,"Running",age > 1800,"DOWN") | convert ctime(recentTime) AS LastActiveOn
| eval age=tostring(age,"duration") | eval host = upper(host)
| table host age LastActiveOn status
| rename host as "Forwarder Name", age as "Last Heartbeat(min)",LastActiveOn as "Last Active On",status as Status

[adonio]

| metadata type=hosts | search host!="YourHost" | eval age = now() - recentTime | eval status= case(age < 1800,"Running",age > 1800,"DOWN") | convert ctime(recentTime) AS LastActiveOn
| eval age=tostring(age,"duration") | eval host = upper(host)
| table host age LastActiveOn status
| rename host as "Forwarder Name", age as "Last Heartbeat(min)",LastActiveOn as "Last Active On",status as Status

[kamlesh_vaghela]

Hi karthi2809,

I'm not sure about to filter index=xx_prod but you can exclude particular host by using below query.

| metadata type=hosts | where host!="hostname"

I hope it will help you.