topic Re: Exclude value based on subsearch in Splunk Search

Exclude value based on subsearch

ngerosa — Tue, 29 Sep 2020 14:40:57 GMT

Hello,
I want to exclude some values if that have the field SPAN_LOSS_MAX=50 between midnight to 7 a.m.

This is my approach:

But this search returns also values that are in the subsearch.

Any Ideas?

Thanks!

Re: Exclude value based on subsearch

rafaelsalazar — Tue, 29 Sep 2020 14:36:44 GMT

Hello ngerosa,

There is already a default hour extraction called date_hour.. if you don't have it, I will recommend building the extraction yourself to be able to filter since search command.

index="flap" DELTA_SPAN>=3 NOT NOT (SPAN_LOSS_MAX=50 AND date_hour>=0 AND date_hour<=7)
| dedup CONCATENATE_Z sortby + _time
| chart count AS FLAP by date_hour

Hope it helps,
Regards.

Re: Exclude value based on subsearch

somesoni2 — Thu, 29 Jun 2017 14:20:41 GMT

Why not just do this

index="flap" DELTA_SPAN>=3 |eval Hour=tonumber(strftime(_time,"%H") )
| where NOT (SPAN_LOSS_MAX=50 AND Hour>=0 AND Hour<7)
|dedup CONCATENATE_Z sortby +_time
| eval Hour=strftime(_time,"%H") 
| chart count as FLAP by Hour

Re: Exclude value based on subsearch

ngerosa — Tue, 29 Sep 2020 14:41:00 GMT

Thanks it works! Just a question:
if I want to exclude also 11 p.m.?
I tried | where NOT (SPAN_LOSS_MAX=50 AND Hour>=0 AND Hour<7 AND Hour !=23 ) but it didn't work.
Thanks

Re: Exclude value based on subsearch

somesoni2 — Thu, 29 Jun 2017 15:06:48 GMT

Try this

...| where NOT (SPAN_LOSS_MAX=50 AND Hour>=23 AND Hour<7)

Re: Exclude value based on subsearch

ngerosa — Thu, 29 Jun 2017 15:25:01 GMT

I've already tried but it didn't work.

Re: Exclude value based on subsearch

rafaelsalazar — Tue, 29 Sep 2020 14:36:53 GMT

NOT (SPAN_LOSS_MAX=50 AND ((Hour>=0 AND Hour<7) OR Hour=23))

Re: Exclude value based on subsearch

ngerosa — Thu, 29 Jun 2017 15:33:02 GMT

Thank you! It works!