https://community.splunk.com/t5/Splunk-Search/Removing-values-from-a-field/m-p/464190#M130837 <P>Hi</P> <P>Try with below</P> <PRE><CODE>your query.... |where NOT status IN ("deferred","sent","expired","bounced") </CODE></PRE> Mon, 10 Feb 2020 10:29:00 GMT vnravikumar 2020-02-10T10:29:00Z https://community.splunk.com/t5/Splunk-Search/Removing-values-from-a-field/m-p/464189#M130836 <P>how to remove values from fields highlighted in red</P> <BLOCKQUOTE> <P>index=main | eval description=case(status == 200, "OK", status == 404, "Not found", status == 500, "Internal Server Error", status == 503, "Service Unavailable", status == 406, "Not Acceptable", status == 400, "Bad Request ", status == 408, "Request Timeout", status == 505, "HTTP Version Not Supported", status == 403, "Forbidden") | table _time status description | where isnotnull(status) | dedup status</P> </BLOCKQUOTE> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/8344i198A8C720EBF3452/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Mon, 10 Feb 2020 10:19:20 GMT https://community.splunk.com/t5/Splunk-Search/Removing-values-from-a-field/m-p/464189#M130836 gagareg 2020-02-10T10:19:20Z https://community.splunk.com/t5/Splunk-Search/Removing-values-from-a-field/m-p/464190#M130837 <P>Hi</P> <P>Try with below</P> <PRE><CODE>your query.... |where NOT status IN ("deferred","sent","expired","bounced") </CODE></PRE> Mon, 10 Feb 2020 10:29:00 GMT https://community.splunk.com/t5/Splunk-Search/Removing-values-from-a-field/m-p/464190#M130837 vnravikumar 2020-02-10T10:29:00Z https://community.splunk.com/t5/Splunk-Search/Removing-values-from-a-field/m-p/464191#M130838 <PRE><CODE>index=main | eval description=case(status == 200, "OK", status == 404, "Not found", status == 500, "Internal Server Error", status == 503, "Service Unavailable", status == 406, "Not Acceptable", status == 400, "Bad Request ", status == 408, "Request Timeout", status == 505, "HTTP Version Not Supported", status == 403, "Forbidden", true(), NULL) | table _time status description | where isnotnull(description) | dedup status </CODE></PRE> Mon, 10 Feb 2020 10:29:48 GMT https://community.splunk.com/t5/Splunk-Search/Removing-values-from-a-field/m-p/464191#M130838 to4kawa 2020-02-10T10:29:48Z https://community.splunk.com/t5/Splunk-Search/Removing-values-from-a-field/m-p/464192#M130839 <P>Unfortunately, it does not work for me. But thank you for answering </P> Mon, 10 Feb 2020 10:40:30 GMT https://community.splunk.com/t5/Splunk-Search/Removing-values-from-a-field/m-p/464192#M130839 gagareg 2020-02-10T10:40:30Z https://community.splunk.com/t5/Splunk-Search/Removing-values-from-a-field/m-p/464193#M130840 <P>Thanks. It's working </P> Mon, 10 Feb 2020 10:40:44 GMT https://community.splunk.com/t5/Splunk-Search/Removing-values-from-a-field/m-p/464193#M130840 gagareg 2020-02-10T10:40:44Z