| dedup _raw
| where NOT MsgId=="AUT22673" OR MsgId=="AUT23574" OR MsgId=="AUT20915" OR MsgId=="AUT22886"
What am I doing wrong here? I expect it to disregard events with that criteria. Its bringing up events with those MsgIds.
↧
Why is my search with "where NOT equals this OR this OR this" not filtering out results as expected?
↧