topic Re: don't show rows with specific column values in Splunk Dev

don't show rows with specific column values

zacksoft — Thu, 08 Mar 2018 11:50:51 GMT

| base search
table amount, currency , received, time

The value of 'received' field is either 0 or 1.

I want my table to show rows where the value of column 'received' is '1'.

Re: don't show rows with specific column values

493669 — Thu, 08 Mar 2018 11:54:38 GMT

Hi @zacksoft,
try this:

|base search|where received="1"|table amount, currency , received, time

Re: don't show rows with specific column values

deepashri_123 — Thu, 08 Mar 2018 11:56:26 GMT

Hey zacksoft,

Try this:
| base search
table amount, currency , received, time | search received = "1"

Let me know if this helps!!

Re: don't show rows with specific column values

zacksoft — Thu, 08 Mar 2018 12:05:19 GMT

This works. Thank u.
One more thing. I also want to add the condition there,
show me only the rows where "received"="1" and "currency" not equal to "dollar" or "sterling" ??

Re: don't show rows with specific column values

493669 — Thu, 08 Mar 2018 12:13:07 GMT

for the additional condition try this:

|base search|where received="1" AND currency!="dollar" AND currency!="sterling" |table amount, currency , received, time

Re: don't show rows with specific column values

deepashri_123 — Thu, 08 Mar 2018 12:17:29 GMT

| base search
table amount, currency , received, time | search received = "1" AND currency!="dollar" AND currency!="sterling"

Please accept the answer if it worked!!
Thanks!!

Re: don't show rows with specific column values

zacksoft — Thu, 08 Mar 2018 12:22:11 GMT

I think this won't work .It is checking here if all three conditions are true.
What I am looking for is received = "1" condition must be true AND Currency not equal to dollar OR Sterling OR Mac.

Hope I didn't confuse

Re: don't show rows with specific column values

deepashri_123 — Thu, 08 Mar 2018 12:34:39 GMT

try this
| base search
table amount, currency , received, time | search received = "1" AND (currency!="dollar" OR currency!="sterling" OR currency!="mac")