Hello
I am trying to extract count of the data by excluding some values which are not equal and some are equal in particular filed
My query
index=platform source=`ProjectArea` |join type=inner ProjectAreaID max=0 [search index=`platform` source=`RequirementModules` |fillnull value="Not Defined"|search Owner!="Tool" |join type=inner ModuleID max=0 [search index=`platform` source=`SoftwareRequirements` `ReqID_URL_Rename`|rename Owner as ReqOwner ]]|search `Software_ModuleType` `SoftwareRequirementType` |fillnull value="Not Defined"|dedup LinkStart_URL|search ModuleID="*" Status="*" Owner="*" | join type=inner LinkStart_URL max=0 [search index=`platform` source=Sw_Satisfaction`|rename LinkEnd_URL as SysURL]|join type=inner SysURL max=0 [search index=`platform` source=`SystemRequirements` `ReqID_URL_Rename` |rename LinkStart_URL as SysURL] |search ModuleName!="A*" AND ModuleName="*_ext" |stats count by ModuleName
Output comes zero when i give (ModuleName!="A*" AND ModuleName="*_ext") this condition
My output contains A* values,V* and A*_ext i want to exculde only A* values
Please help with this
Thank You in advance
Renuka
Instead of search, can you use regex?
| regex ModuleName="^[^A].*_ext$"
Thanks for reply I will try @ITWhisperer