topic Re: Exclude events with specific field value from results in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Exclude-events-with-specific-field-value-from-results/m-p/87400#M18123 <P>You could simply add the search term "UserLoginName!=SYSTEM" or "NOT UserLoginName=SYSTEM" to the first command of your search :</P> <P><PRE><CODE><BR /> source="mysource" UserLoginName!="SYSTEM" | sort -_time | table UserLoginName _time | dedup UserLoginName<BR /> </CODE></PRE></P> <P>If you are curious to find out more about the search language and its syntax, I recommend to consult our search tutorial :</P> <P><A href="http://www.splunk.com/base/Documentation/latest/User/WelcometotheSplunktutorial">http://www.splunk.com/base/Documentation/latest/User/WelcometotheSplunktutorial</A></P> Sat, 23 Apr 2011 18:54:57 GMT hexx 2011-04-23T18:54:57Z Exclude events with specific field value from results https://community.splunk.com/t5/Getting-Data-In/Exclude-events-with-specific-field-value-from-results/m-p/87399#M18122 <P>How would I exclude all events which contain a specific field value from a set of search results?</P> <P>For instance:<BR /> source="mysource" | sort -_time | table UserLoginName _time | dedup UserLoginName</P> <P>Gives me a table of usernames and last login time.</P> <P>I'd like to filter out one of the users (say, SYSTEM) from the results...</P> Sat, 23 Apr 2011 18:33:13 GMT https://community.splunk.com/t5/Getting-Data-In/Exclude-events-with-specific-field-value-from-results/m-p/87399#M18122 beaunewcomb 2011-04-23T18:33:13Z Re: Exclude events with specific field value from results https://community.splunk.com/t5/Getting-Data-In/Exclude-events-with-specific-field-value-from-results/m-p/87400#M18123 <P>You could simply add the search term "UserLoginName!=SYSTEM" or "NOT UserLoginName=SYSTEM" to the first command of your search :</P> <P><PRE><CODE><BR /> source="mysource" UserLoginName!="SYSTEM" | sort -_time | table UserLoginName _time | dedup UserLoginName<BR /> </CODE></PRE></P> <P>If you are curious to find out more about the search language and its syntax, I recommend to consult our search tutorial :</P> <P><A href="http://www.splunk.com/base/Documentation/latest/User/WelcometotheSplunktutorial">http://www.splunk.com/base/Documentation/latest/User/WelcometotheSplunktutorial</A></P> Sat, 23 Apr 2011 18:54:57 GMT https://community.splunk.com/t5/Getting-Data-In/Exclude-events-with-specific-field-value-from-results/m-p/87400#M18123 hexx 2011-04-23T18:54:57Z