topic Re: Exclude words from subject in Getting Data In

Exclude words from subject

priya0709 — Thu, 05 Nov 2020 11:22:10 GMT

I have to exclude all subject with some similar set of words in subject.

Eg. Inc00452| RE: Exchange 2K16: Alert: Processor > % Processor Time

So I have to exclude all subject with 'Alert: Processor > % Processor Time'

So all subject with above keyword should be excluded

inventsekar — Thu, 05 Nov 2020 12:32:53 GMT

Hi @priya0709 your question is not clear.. please provide us some more details, thanks.

dauren_akilbeko — Thu, 05 Nov 2020 12:50:57 GMT

priya0709 — Thu, 05 Nov 2020 13:04:41 GMT

My requirement is to exclude all subjects which has words "Alert: Processor > % Processor Time" in subject

Please see attached my query

priya0709 — Wed, 09 Dec 2020 02:06:57 GMT

Please see attached

isoutamo — Thu, 05 Nov 2020 15:16:26 GMT

Are you meaning that this text will removed:
- your query output
- already from events before it has stored to splunk
- something else
r. Ismo

inventsekar — Fri, 06 Nov 2020 01:39:14 GMT

Hi Priya, you were saying about logs ingestion at HF and filtering at HF?

or you were saying about the "alerts" email notification subject line?

Maybe, You could send a direct message here from your profile to me, so that we can understand and resolve your issue faster, thanks.