topic exclude particular statement from the input in Getting Data In

exclude particular statement from the input

Jananee_iNautix — Wed, 29 Jan 2014 14:32:57 GMT

I have different log statements like

2014-01-09 02:04:09,121 [450d450d] MAJOR: FTP Inbound Agent : Directory [] File [] on Server [10.6.16.222]
2014-01-11 00:01:01,050 [608c608c] MAJOR: SFTP Inbound - Zero Byte File Check
2013-12-05 15:34:00,895 [275f275f] +MAJOR: Stacktrace of root exception
.
.
.
etc
Some search is appplied on the above statements and a report is created.I want to exclude the log statement
"2014-01-11 00:01:01,050 [608c608c] MAJOR: SFTP Inbound - Zero Byte File Check"
in the log file from being searched and create a report.Is there any option in splunk to do this?

Re: exclude particular statement from the input

lukejadamec — Wed, 29 Jan 2014 14:48:56 GMT

Try adding the following to your search portion of your search. The NOT must be all caps.

NOT "*MAJOR: SFTP Inbound - Zero Byte File Check*"

Re: exclude particular statement from the input

Jananee_iNautix — Thu, 30 Jan 2014 05:52:57 GMT

i gave the search like
index=fxr file AND (MAJOR) OR (SUCCESS: AND File AND successfully AND uploaded) NOT"*MAJOR: SFTP Inbound - Zero Byte File Check*" but its not getting excluded.Please help

Re: exclude particular statement from the input

kristian_kolb — Thu, 30 Jan 2014 08:19:48 GMT

Slightly rewritten for readability - does this produce the desired results?

index=fxr (SUCCESS File successfully uploaded) OR (MAJOR NOT "SFTP Inbound - Zero Byte File Check")