We have a number of alerts set up with Splunk.  One of them monitors the state of VPN's from our Cisco routers.  One of these routers has a couple of VPN's that are actually supposed to be down (until they get traffic sent over them) so we keep getting a false positive on the alert.  This is the query: splunk query - sourcetype="cisco:ios" AND "down"  I am VERY new to this and writing queries.  What is the syntax I need to add to this query that will ignore this one particular router?   Thank you for any Reply -  ... View more