I am attempting to create a sorted count list of useragents that customers are using to browse my website.
I want to exclude certain results and only show events of unknown agents,bots,vulnerability scanners.
Currently I am using the string
index = UV | where NOT like(ad_UserAgent,"%Mozilla%") OR like(ad_UserAgent,"%Opera%") | stats count by ad_UserAgent | sort - count
Is there something I am doing wrong that is still showing events that contain Mozilla and Opera?
thank you for the assistance.
... View more