search query

[DTERM]

What is wrong with the following?

index="app" | top productName NOT productName = "Not Specified"

I want to extract a list of product names but I don't want to include "Not Specified" as part of the set.

TIA

[sfleming · Accepted solution]

Try excluding "not specified" in the original search string, before calling the top command. Also, use !=

index="app" productName!="Not Specified" | top productName