I need to do an analyze/audit/summary/event_type=(breakin,logfail) but would like to exclude a particular remote source.
I had hoped that the /noselect qualifier would accept the same fields as the /select qualifier (eg /select=remote=ident=blah), but it doesn't seem to work that way. I must admit, the documentation didn't lead me to believe that it would, but I thought I'd give it a go (I couldn't really see a use for a plain "/noselect" qualifier).
So, does anyone else have any ideas on how to do this using the analyze/audit command.
I know I can do it with a program, or by parsing the output of 2 commands (one for the whole and one for just the device in question) and munging figures. I'm just trying to get out of more work than is absolutely necessary.
