I have a list of subnets that I want to exlude from search.
below isthe search
| search NOT cidrmatch("xx.xx.xx.xx/24",src) OR cidrmatch("xx.xx.xx.xx/22",src) OR cidrmatch("xx.xx.xx.xx",src) OR cidrmatch("xx.xx.xx.xx/21",src) OR cidrmatch("xx.xx.xx.xx/22",src) OR cidrmatch("xx.xx.xx.xx/24",src) OR cidrmatch("",src)
What is your question? Aside from needing parentheses around the NOT clause, the query is fine.
| search NOT (cidrmatch("xx.xx.xx.xx/24",src) OR cidrmatch("xx.xx.xx.xx/22",src) OR cidrmatch("xx.xx.xx.xx",src) OR cidrmatch("xx.xx.xx.xx/21",src) OR cidrmatch("xx.xx.xx.xx/22",src) OR cidrmatch("xx.xx.xx.xx/24",src) OR cidrmatch("",src) )