https://community.splunk.com/t5/Getting-Data-In/Filtering-a-Search/m-p/300556#M56821 <P>You can remove events from search results by specifying filters, preferably in base search like this</P> <PRE><CODE>index=foo sourcetype=bar http_status=200 NOT ("WhatsUp/1.0") </CODE></PRE> <P>You can refer to Splunk search tutorial for more examples.<BR /> <A href="http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchTutorial/Usethesearchlanguage">http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchTutorial/Usethesearchlanguage</A></P> Thu, 24 Aug 2017 20:06:45 GMT somesoni2 2017-08-24T20:06:45Z https://community.splunk.com/t5/Getting-Data-In/Filtering-a-Search/m-p/300555#M56820 <P>Hi there, so I had a nice search return but I have a few bits that I don't want in the search. Really all I care about are the HTTP responses of 200 and I don't want to see anything with "WhatsUp/1.0" because that's just noise. Is there a good piece of documentation on this?</P> <P>Trying to figure out what kind of web traffic is on a really old server that needs to be retired. Also, is there good documentation on this type of practice?</P> Thu, 24 Aug 2017 19:55:11 GMT https://community.splunk.com/t5/Getting-Data-In/Filtering-a-Search/m-p/300555#M56820 heats 2017-08-24T19:55:11Z https://community.splunk.com/t5/Getting-Data-In/Filtering-a-Search/m-p/300556#M56821 <P>You can remove events from search results by specifying filters, preferably in base search like this</P> <PRE><CODE>index=foo sourcetype=bar http_status=200 NOT ("WhatsUp/1.0") </CODE></PRE> <P>You can refer to Splunk search tutorial for more examples.<BR /> <A href="http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchTutorial/Usethesearchlanguage">http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchTutorial/Usethesearchlanguage</A></P> Thu, 24 Aug 2017 20:06:45 GMT https://community.splunk.com/t5/Getting-Data-In/Filtering-a-Search/m-p/300556#M56821 somesoni2 2017-08-24T20:06:45Z https://community.splunk.com/t5/Getting-Data-In/Filtering-a-Search/m-p/300557#M56822 <P>Do you have to specify the source type?</P> Thu, 24 Aug 2017 20:26:03 GMT https://community.splunk.com/t5/Getting-Data-In/Filtering-a-Search/m-p/300557#M56822 heats 2017-08-24T20:26:03Z https://community.splunk.com/t5/Getting-Data-In/Filtering-a-Search/m-p/300558#M56823 <P>Oh I see, it looks like status= not http_status This looks good! Thank you for the documentation! </P> Thu, 24 Aug 2017 20:30:20 GMT https://community.splunk.com/t5/Getting-Data-In/Filtering-a-Search/m-p/300558#M56823 heats 2017-08-24T20:30:20Z https://community.splunk.com/t5/Getting-Data-In/Filtering-a-Search/m-p/300559#M56824 <P>Specifying more metadata field filters (index/host/source/sourcetype etc) in base search can optimize the performance.</P> Thu, 24 Aug 2017 20:49:37 GMT https://community.splunk.com/t5/Getting-Data-In/Filtering-a-Search/m-p/300559#M56824 somesoni2 2017-08-24T20:49:37Z