https://community.splunk.com/t5/Getting-Data-In/Journald-exclude-specific-services/m-p/670079#M112364 <P>Hi, we have multiple services that we want to have filtered out from the&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/9.1.1/Data/CollecteventsfromJournalD" target="_self">journald</A>. Is there a way to do the opposite of this stanza parameter? to exclude&nbsp;_SYSTEMD_UNIT=my.service<BR /><BR /></P><PRE>journalctl-filter =_SYSTEMD_UNIT=my.service</PRE><P>&nbsp;</P><P>&nbsp;If that's not possible, what's the best way to do that?</P> Tue, 28 Nov 2023 21:35:57 GMT elbashandy 2023-11-28T21:35:57Z https://community.splunk.com/t5/Getting-Data-In/Journald-exclude-specific-services/m-p/670079#M112364 <P>Hi, we have multiple services that we want to have filtered out from the&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/9.1.1/Data/CollecteventsfromJournalD" target="_self">journald</A>. Is there a way to do the opposite of this stanza parameter? to exclude&nbsp;_SYSTEMD_UNIT=my.service<BR /><BR /></P><PRE>journalctl-filter =_SYSTEMD_UNIT=my.service</PRE><P>&nbsp;</P><P>&nbsp;If that's not possible, what's the best way to do that?</P> Tue, 28 Nov 2023 21:35:57 GMT https://community.splunk.com/t5/Getting-Data-In/Journald-exclude-specific-services/m-p/670079#M112364 elbashandy 2023-11-28T21:35:57Z