Hi,
I’m using this:
count_over_time({job=~“Server56|Server59”}[60s] |= “EventID":4625”)
to get alerts from my windows server eventlogs. And it’s working great. But now I would like to filter out any alerts that got the EventID 4625 and the hostname PC1 to not alert me.
Is this the right way:
count_over_time({job=~“Server56|Server59”}[60s] |= “EventID":4625” && !=“PC1”)
No, it is not. I just tested it and I got an error msg. And is it even possible to filter for more than one word ?
I’m a bit puzzled about it, so any suggestions are welcome.
Best regards
fatcharly