I have a search defined as
status=deny
The search list the result correctly. From this result there is a field dst which has an IP as its value. How could I further filter my search for the dst to not have a certain IP address?
For eg how could I achieve the result to not list say IP=255.255.255.255
I have tried this and it does not work: status=deny | where (dst not like "255.255.255.255")
The where above cannot take not as an argument. I am trying to filter the result to not have 255.255.255.255
Any help would be apprecaited.
Thanks.
It's as simple as using boolean operators directly in your base query.
status=deny AND NOT dst="255.255.255.255"
Even if where
WOULD have accepted your syntax, it makes for a very inefficient search because what would happen is that the initial search command would retrieve ALL events that have "status=deny" before passing it on to the next command in the search pipeline. By filtering directly in the base search your query becomes much more efficient because only the events you're interested will actually be retrieved from the index.
Thanks a lot Jonuwz and Ayn... You folks ROCK !!!!
+1 for explaining why 🙂