where operation with multiple search criteria + regex

[HattrickNZ]

This is my search

index=X ....| 
search column!="T*" column!="I*" column!="m*" column!="l*" column!="d*"           

What is the shortest way to write the search part. I was hoping to use regex (e.g. search column!="[TlmId*")but that does not seem to work. Can anyone advise of a less verbose way of writing this?

[woodcock]

Use regex instead of search, like this:

| regex column!="^[TImld]"

[DalJeanis]

Try this -

| where NOT match(column,"^[TImId]")

match looks for any subset of the field, so you use an anchor ^ to lock it to the beginning, and you don't have to worry about the *. You do have to close the square bracket to complete the specification of what kind of characters will match.

[tmarlette]

regex very well may be a better option here, but I can't see enough of your search to tell you how effective it would be

can you copy your whole search query and anonymize whatever is necessary?

for instance

index=myIndex sourcetype=mySourcetype  host=myHost | stats count by host username logingId