Attempting to run a tstats search that excludes a collection of IPv6 ranges from the results as follows:
| tstats summariesonly=true allow_old_summaries=true count from data model=this where this.that="foo" NOT [|inputlookup ip_subnets.csv | rename cidr as src_ip] by this.src_ip
Upon running the search, I'm hit with the error 'tsidxStats: WHERE clause is not an exact query'. My gut told me that ipv6 may have had something to do with it, so I reran tests with lookups where ipv6 ranges were excluded and the searches ran successfully. Matching both ipv4 and ipv6 works as expected in non-tstats searches, so I'm not sure if ipv6 cidr range matching is supported within tstats. Can anyone assist?
