All,
I have a list of IP addresses which is about 40 long I don't want to include in my search. Seems silly to type NOT NOT NOT NOT 40+ times. Is there a way for me to place an array of ipaddresses and use a single NOT ?
Yes, use a subsearch that loads a lookup csv file:
sourcetype=things NOT [ inputlookup iplist.csv | fields ip_addr ]
The iplist.csv lookup file should contain a column called ip_addr
. if the field name in your sourcetype does not match the column name in the lookup file, you can use the rename
command to rename the field.
Going back to laws of boolean artihmetics, not X and not Y
is the same as not (X or Y)
- if you just want to cut down the number of nots you can use this.
Another solution would be to tag your IPs and exclude that one tag.