topic Re: How to not include particular source in Splunk query in Dashboards & Visualizations

How to not include particular source in Splunk query

aditsss — Thu, 13 Jul 2023 15:02:10 GMT

Hi Team,

I am creating one Splunk query as below:

index="600000304_d_gridgain_idx*" sourcetype=600000304_gg_abs_ipc2 source="/app/abs-upstreamer/logs/abs-upstreamer.log"

I am getting events from another which I don't want to be included in my query

I don't want this particular source ="/var/app" to be included in my query.

Please guide how can I exclude that from my query

Re: How to not include particular source in Splunk query

gcusello — Thu, 13 Jul 2023 15:04:45 GMT

Hi @aditsss,

if in your main search you have the condition source="/app/abs-upstreamer/logs/abs-upstreamer.log", you cannot have events with source="/var/log/*".

Maybe is the "/var/log" in another field?

Ciao.

Giuseppe

Re: How to not include particular source in Splunk query

aditsss — Thu, 13 Jul 2023 15:12:16 GMT

@gcusello

Thanks for update

I am getting events from two source

1)source="/app/abs-upstreamer/logs/abs-upstreamer.log"

2) source ="/var/log"

I want my query like this from which I don't want events from source ="/var/log"

currently I am not using any source:

index="600000304_d_gridgain_idx*" sourcetype=600000304_gg_abs_ipc2 "Total msg processed for trim reage file:"

I am getting events from both the sources but I don't want event from this source ="/var/log"

Could you guide me on this

Re: How to not include particular source in Splunk query

gcusello — Thu, 13 Jul 2023 15:15:50 GMT

Hi @aditsss,

if you have two sources, I hint to use the source you want in the main search, because a positive filter is always more efficient than a negative one.

If you could have more sources and you want to exclude someone, you can use

index="600000304_d_gridgain_idx*" sourcetype=600000304_gg_abs_ipc2 "Total msg processed for trim reage file:" source!="/var/log/*"

Ciao.

Giuseppe

Re: How to not include particular source in Splunk query

ITWhisperer — Thu, 13 Jul 2023 15:16:20 GMT

index="600000304_d_gridgain_idx*" sourcetype=600000304_gg_abs_ipc2 "Total msg processed for trim reage file:" source="/app/abs-upstreamer/logs/abs-upstreamer.log"