topic Re: Removing source rows based on field values. in Splunk Enterprise

Removing source rows based on field values.

richtate — Tue, 21 Sep 2021 19:18:19 GMT

I have a index with thousands of operating systems (OS). I want to remove unwanted operating systems (OS) from my report using wild cards as many of the unwanted share the same value as part of the OS.

Here is what I'm trying to do:

earliest=-15d@d index="asset" sourcetype="Tenable:SecurityCenter:Asset"
WHERE operating_system NOT "[APC*" OR "[AIX*"
| stats count by operating_system

I want to remove OS that have APC or AIX ( and others not listed) from the query. But I can't use a wildcard which would mean hundreds of entries just for APC and all the versions I want to exclude. I've tried NOT IN, NOT LIKE, != and more but either nothing is returned or what I want filtered out is not filtered and all events are returned. Suggestions?

Re: Removing source rows based on field values.

ITWhisperer — Tue, 21 Sep 2021 22:22:28 GMT

| regex operating_system!="^\[(APC|AIX)"

Re: Removing source rows based on field values.

richtate — Tue, 21 Sep 2021 22:27:15 GMT

I gave that a try and still getting those OS returned:

Re: Removing source rows based on field values.

ITWhisperer — Tue, 21 Sep 2021 22:45:23 GMT

These operating systems don't have the leading [ which you had in your original post - try this instead

| regex operating_system!="(APC|AIX)"