not matches?

Comments

2 comments

  • Avatar
    David Gadoury

    Bob,

    You can use one of the following formats:

    | where !(field="value")

    | where !(field matches "*value*"


    Here is an example

    _sourceCategory=Apache/Access 404
    | parse regex "HTTP/1\.1\" (?<status_code>\d+) (?<size>\d+) \"http://(?<url>.*?)[/\"]"
    | where !(url matches "*YOUR DOMAIN")

    2
    Comment actions Permalink
  • Avatar
    Bob Scheld

    Perfect - I figured it was something obvious. I just didn't have the negate operator (!) in the right place.  Thanks,

    0
    Comment actions Permalink

Please sign in to leave a comment.