query question does not contain or not like

[Anonymous]

How can I query on something  using "not contains "

how?

[Anonymous]

i've found regex is the easiest way to do a doesn't contains.

[LeeKirkpatrick · Accepted solution]

Hey Bechara3,

Try the below syntax in an advanced query:

~(<meta-key> contains '<yourValue>')

For example, the below would query all users that DO NOT contain 'Lee':

~(user.dst contains 'Lee')

[SahilArora]

does this work with reporting? i am trying to use it, but keeps giving me 'invalid expression' error

[JoshRandall]

Try using the following syntax:

not(<meta_key> contains <meta_value>)

e.g.:

not(alias.host contains ‘rsa.com')

You can use the same syntax for begins and ends queries.  e.g.:

not(user.dst ends ‘$')

not(netname begins ‘private','multicast')

[JoshRandall]

Also, make sure you have quotes around your metavalue --> '