flow.device=ROUTERDEVICE & flow.interface.in=GigabitEthernet0/0.1
This does not:
flow.device=ROUTERDEVICE & flow.interface.in!=GigabitEthernet0/0.1
It would be nice to report/alert on these flows to determine devices connected to the wrong networks. Or finding traffic between networks at a remote site that is unexpected.
http://www.liveaction.com/introducing-livenx-6-0/ introduced some Not Equal features:
9. Not Equal Flex Search
You can now use != (Not equal) in your flex search. The != flex filter is supported for the following fields: