select subset of hosts

[BertKraan]

Hello, splunk newbie here,

I have tens of servers named like abc01, abc02 .... abc20. Now i would like to search for events on a subset of these machines like for example only the abc18 and abc19. I'm trying searches like

index="prd_access" sourcetype="access:web:foo" earliest=-7d latest=now | regex "abc(18|19)"

This seems to work but how can i select data from everything except these "abc(18|19)" ?

host!="abc(18|19)"

doesn't seem to work..

Thanks in advance,

Bert

[somesoni2]

you can try using following query

index="prd_access" sourcetype="access:web:foo" earliest=-7d latest=now | search NOT ("abc18" OR "abc19")

[zeroactive]

I would use the following:

index="prd_access" sourcetype="access:web:foo" earliest=-7d latest=now NOT host=abc18 NOT host=abc19

There's not a need to run a second search via the | operator, just go ahead and filter out those hosts in the first search command.

[BertKraan]

Will give it a try, thanks!