Hi all,  I have run in to a wall on a query I am attempting. I am receiving an error on my log, and one of the items is there for good reason but my system still picks it up. The error is one long string (mostly) and I have used rex to extract both items as values and place them in a table, but they are gathered by message and I cannot get the system to acknowledge a not statement. Here is what I have: Basic search path | rex field=_raw max_match=0 "(?<Error>TCM-\d{5}).*?rowKey=(?<Value>\w*?),.*?]\)"| where not Value = CASHAMT | Table Error Value I have also tried != as well with little effect. I still get it in the table as one of three items for the days. if I do "CASHAMT" then it shows me no values (presumably because all the errors are in one message?)  I just do not want the error and value to show up on table when value = CASHAMT for that row. Any thoughts on this would be very useful, any further context I can provide as well ... View more