https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-results-based-on-2-values-in-an-event/m-p/347080#M63751 <P>Try using <CODE>NOT (host=DomainController1 AND Message="Bad Username")</CODE></P> Tue, 17 Apr 2018 20:09:44 GMT kmaron 2018-04-17T20:09:44Z https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-results-based-on-2-values-in-an-event/m-p/347079#M63750 <P>I'm trying to use a where command to filter a search based on 2 values in an event.</P> <P>So something like where <CODE>host!=Domain Controller1 and Message!="Bad Username"</CODE></P> <P>But doing it this way is filtering any events that match either host or Message. How can I filter results based on 2 field values?</P> Tue, 17 Apr 2018 19:37:50 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-results-based-on-2-values-in-an-event/m-p/347079#M63750 Sparky1 2018-04-17T19:37:50Z https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-results-based-on-2-values-in-an-event/m-p/347080#M63751 <P>Try using <CODE>NOT (host=DomainController1 AND Message="Bad Username")</CODE></P> Tue, 17 Apr 2018 20:09:44 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-results-based-on-2-values-in-an-event/m-p/347080#M63751 kmaron 2018-04-17T20:09:44Z