How can I query on something using "not contains "
Try the below syntax in an advanced query:
~(<meta-key> contains '<yourValue>')
For example, the below would query all users that DO NOT contain 'Lee':
~(user.dst contains 'Lee')
i've found regex is the easiest way to do a doesn't contains.
does this work with reporting? i am trying to use it, but keeps giving me 'invalid expression' error
Try using the following syntax:
not(<meta_key> contains <meta_value>)
not(alias.host contains ‘rsa.com')
You can use the same syntax for begins and ends queries. e.g.:
not(user.dst ends ‘$')
not(netname begins ‘private','multicast')
Also, make sure you have quotes around your metavalue --> '
Retrieving data ...