This is the data between October and December of something.
I want to find data that have accessed by October but never accessed in December.
If I do what I think, the result should show b only. But it did not work well.
so I wrote in search bar like
@timestamp:[* TO 2018-10-31T23:59:59.999Z ] AND NOT @timestamp:[2018-12-01T00:00:00.000Z TO now ]
This is result.
What's the problem?