https://community.splunk.com/t5/Getting-Data-In/Can-I-consolidate-multiple-arbitrary-strings-into-an-include/m-p/290553#M55425 <P>Greetings,</P> <P>I'd like to remove some spurious errors from my application by filtering them out. Each error is distinct, and they all have a common format. As per usual, my application deals with fruit. How can I filter out the following 7 errors without having to make each one a literal string? </P> <P>Examples I want to filter out:</P> <UL> <LI> "This fruit is rotten" </LI> <LI>"A blemish has this fruit" </LI> <LI>"Brown spots appear" "This</LI> <LI>"fruit smells like a banana, but is not a banana" </LI> <LI>"Smooshy, way too smooshy"</LI> <LI>"Hard like a rock"</LI> </UL> <P>Examples I still want to keep in:</P> <UL> <LI>"This is a rock, not fruit"</LI> <LI>"This fruit has metal embedded in it"</LI> <LI>"Mangled beyond recognition"</LI> </UL> <P>My assumption is that I will have to create a search string which specifically 'NOTs' all of the examples in the top list. </P> Tue, 15 Aug 2017 21:28:44 GMT dreeck 2017-08-15T21:28:44Z https://community.splunk.com/t5/Getting-Data-In/Can-I-consolidate-multiple-arbitrary-strings-into-an-include/m-p/290553#M55425 <P>Greetings,</P> <P>I'd like to remove some spurious errors from my application by filtering them out. Each error is distinct, and they all have a common format. As per usual, my application deals with fruit. How can I filter out the following 7 errors without having to make each one a literal string? </P> <P>Examples I want to filter out:</P> <UL> <LI> "This fruit is rotten" </LI> <LI>"A blemish has this fruit" </LI> <LI>"Brown spots appear" "This</LI> <LI>"fruit smells like a banana, but is not a banana" </LI> <LI>"Smooshy, way too smooshy"</LI> <LI>"Hard like a rock"</LI> </UL> <P>Examples I still want to keep in:</P> <UL> <LI>"This is a rock, not fruit"</LI> <LI>"This fruit has metal embedded in it"</LI> <LI>"Mangled beyond recognition"</LI> </UL> <P>My assumption is that I will have to create a search string which specifically 'NOTs' all of the examples in the top list. </P> Tue, 15 Aug 2017 21:28:44 GMT https://community.splunk.com/t5/Getting-Data-In/Can-I-consolidate-multiple-arbitrary-strings-into-an-include/m-p/290553#M55425 dreeck 2017-08-15T21:28:44Z https://community.splunk.com/t5/Getting-Data-In/Can-I-consolidate-multiple-arbitrary-strings-into-an-include/m-p/290554#M55426 <P>You can do this with a subsearch:<BR /> <A href="https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchTutorial/Useasubsearch">https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchTutorial/Useasubsearch</A></P> <P>OR if you are on the latest version of Splunk, with the <CODE>IN</CODE> operator (hooray for @richfez):<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.6.2/SearchReference/ConditionalFunctions#in.28VALUE-LIST.29">http://docs.splunk.com/Documentation/Splunk/6.6.2/SearchReference/ConditionalFunctions#in.28VALUE-LIST.29</A></P> Tue, 15 Aug 2017 23:56:08 GMT https://community.splunk.com/t5/Getting-Data-In/Can-I-consolidate-multiple-arbitrary-strings-into-an-include/m-p/290554#M55426 woodcock 2017-08-15T23:56:08Z