Here are some docs and query samples to get you started
What you are trying to achieve is entirely possible. You will want to use the "src" search module which is documented here: https://dev.gravwell.io/docs/#!search/src/src.md
The src module can filter based on the SRC field using direct comparison and subset filtering.
Here are your two queries using the src module:
tag=syslog src == 10.1.1.1 | table SRC DATA
tag=syslog src != 10.1.1.1 | unique SRC | table SRC DATA
The eval module can accomplish the same thing, but because it has significantly more capability it has two caveats. First, it is not as type aware as some of the others so you may need to explicitly tell it what type it is expecting.
tag=syslog unique SRC | eval toString(SRC) != "10.1.1.1" | table SRC DATA
The other thing to remember is that eval can do a lot more than filtering, so it must be a collapsing module. This may have significant performance impacts when used for bulk filtering.