New to the community so all help is appreciated! Requirement We have a requirement to filter some network data in a correlation search to return any data which has a public ip in the "src" or "dest" field.  Solution I tried several variants of this: ... | search (src!="10.0.0.0/8" OR src!="192.168.0.0/16" OR src!="172.16.0.0/12") AND (dest!="10.0.0.0/8" OR  dest!="192.168.0.0/16" OR dest!="172.16.0.0/12") I boiled it down to this, which also does not work: ... | search src!="10.0.0.0/8" AND dest!="10.0.0.0/8" It appears that my query is evaluating the first "OR" individually, meaning that no matter what I set the dest!= filter to it does not return results. My Request Clearly I don't understand the logic being used for OR/AND operators and a better understanding of that would be appreciated. Ultimately though, I'm not stuck on this logic, so if there is a better way to only return results which has a public ip in the src OR dest fields I'm happy to learn the best way to do that as well! Thanks in advance for the help! ... View more