Searches can return a large number of events, some of which are not important to you. You can filter search results to focus on the events that matter to you. For example, after running a search, you realize you do not need to see events from a particular domain. To tailor the search without manually modifying the query, you can use an option on parsed domain fields in the search results.
To filter search results:
Select Investigate > Search to open the search page.
Right-click a cell in the search results and select Exclude from Query.
A NOT statement is added to the query.
Click Search. The search results omit events containing the data you excluded in the previous step.