topic How to exclude all days of one month from a time range? in Splunk Search

How to exclude all days of one month from a time range?

chinmay25 — Thu, 28 May 2020 18:33:29 GMT

Here is the part of the search that I am working on, and trying to exclude certain numbers of days. However, where Date != 20190401 removes only April 1st from the result. I need to exclude all the days of April.

index:

| where Date != "20190401"
| stats sum(claim_nums) as "Total Claims" by Date
| appendpipe [ stats avg("Total Claims") as ClaimAvg 
| eval ClaimAvg = round(ClaimAvg,2) | eval "Total Claims" = "TOTAL AVG CLAIMS ".ClaimAvg 
| fields - ClaimAvg]
| sort - DATE

I tried adding multiple dates in the where command, but it doesn't work.

Re: How to exclude all days of one month from a time range?

DalJeanis — Thu, 28 May 2020 20:34:34 GMT

I'll bet you tried

| where Date != "20190401" OR  Date != "20190402"

Every record will always be either not the first value or not the second value. You need to use AND to make that kind of code work.

However, you can also do something like this to test them all at the same time, assuming Date is a text field.

| where ( substr(Date,1,6)!="201904" )

Re: How to exclude all days of one month from a time range?

chinmay25 — Thu, 28 May 2020 20:51:56 GMT

Thanks. Yes I tried the first option but it didn't work. The second option works perfect. Thanks.