I'm trying to run the following search and I still get the results from the index even after I mention I NOT to see the results from these particular indexes, need help with correcting this search to ignore the indexes
| dbinspect index=* NOT index=_internals NOT index=_introspection NOT index=collectd NOT index=splunkforwarders NOT index=_audit| search state=hot | eval diff=now()-endEpoch | eval daysAlive=diff/60/60/24 | where daysAlive > 35 | convert ctime(startEpoch) | convert ctime(endEpoch) | stats sum(sizeOnDiskMB) as diskSpace
dbinspect
accepts more than one index name, but doesn't accept a search-like expression. Try this alternative:
| dbinspect index=* | search NOT index=_internal NOT index=_introspection NOT index=collectd NOT index=splunkforwarders NOT index=_audit| search state=hot | eval diff=now()-endEpoch | eval daysAlive=diff/60/60/24 | where daysAlive > 35 | convert ctime(startEpoch) | convert ctime(endEpoch) | stats sum(sizeOnDiskMB) as diskSpace