!~
The !~ (not equals) operator applies a case-insensitive string filter and excludes events that match.
The following table provides a comparison of the equal operators:
| Operator | Description | Case-Sensitive | Example (yields true) |
|---|---|---|---|
== | Equal | Yes | "aBc" == "aBc" |
!= | Not equal | Yes | "abc" != "ABC" |
=~ | Equal | No | "abc" =~ "ABC" |
!~ | Not equal | No | "aBc" !~ "xyz" |
When comparing values of different types, Cribl Search performs automatic type conversion wherever possible, giving priority to number comparisons.
For more details on comparison rules, see:
Syntax
Scope | where Field !~ (Expression, ... )
Arguments
- Scope: The input tabular result set to filter.
- Field: The field to filter.
- Expression: An expression used to filter.
Example
dataset=myDataset
| summarize event_count=count() by State
| where (State !~ "texas") and (event_count > 3000)
| project State, event_count