This is a bit quick and dirty but...
sourcetype=your_sourcetype src_ip=":"
One that works for me
src_ip="*:*"
This is the simplest way i could come up with.
| regex src_ip!="(^[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}$)"
This will remove all IPv4 addresses from your search. don't forget to switch "src_ip" to what field you are searching. (e,g, dest_ip, rx_hosts, tx_hosts)
this is the most simplest way i came up with.
| regex src_ip!="(^[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}$)"
this will remove all IPv4 addresses from your search.
This is a bit quick and dirty but...
sourcetype=your_sourcetype src_ip=":"
I feel as though I should slap myself in the face for not figuring this out on my own! just tried it and it worked. did this src_ip=":"