Try this. There will be 4 (#src) * 3 (#src_port) * 2 (#dest) * 5(#dest_port) =120 combinations to be excluded. The subsearch generates the same. See Inspect job for Normalized search.
your base search NOT [| gentimes start=-1 | eval src=split("192.168.10.12 192.168.10.13 192.168.10.64 192.168.10.65"," ") | table src | mvexpand src | eval src_port=split("25000 143 25002", " ") | mvexpand src_port | eval dest=split("192.168.17.20 192.168.17.21"," ") | mvexpand dest | eval dest_port=split("443 25000 143 25001 993"," ") | mvexpand dest_port | format]
... View more