How to filter message by cp_id - to exclude some traffic

Answered

Comments

2 comments

  • Avatar
    Jason Glover

    Duh!

    _sourceCategory=IIS_Logs and not (c_ip ="120.138.24.181" or c_ip ="50.54.162.242" or c_ip = "124.157.127.78" or c_ip ="124.157.108.250") | parse "GET /p/* " as handle | where length(handle) > 1 | count by handle | sort by _count desc

  • Avatar
    Dwayne Hoover

    Hey Jason,
    Glad you found the answer. One suggestion, we also have a couple of CIDR operators that can be helpful in these situations. Have a look: https://service.sumologic.com/help/CIDR_Operator.htm

    Thanks!

Please sign in to leave a comment.