Exclude results where two or more fields match

iomega311 — Wed, 19 Aug 2020 20:44:52 GMT

I am trying to understand how to remove results where "field_a" and "field_a" each contain a certain value together in the same log... but not all results containing "field_a" or all results containing "field_b"... or any other fields.

Here are some example of logs:

field_a=5 field_b=3

field_a=5 field_b=2

field_a=2 field_b=3

I want to exclude only logs where field_a is equal to "5" AND field_b is equal to "3" ... but keep all other results. So, in the log examples above, I would only want to exclude the first log because that is the only example where BOTH fields contain a specific value... I would want my query to return the last two logs.

Re: Exclude results where two or more fields match

sbuntin_splunk — Wed, 19 Aug 2020 21:09:48 GMT

NOT ( field_a=5 AND field_b=3 )

add this within your base search or in subsequent search command

Re: Exclude results where two or more fields match

richgalloway — Wed, 19 Aug 2020 21:10:54 GMT

Perhaps this will help.

index=foo NOT (field_a=5 AND field_b=3)

topic Exclude results where two or more fields match in Splunk Search

Exclude results where two or more fields match

Re: Exclude results where two or more fields match

Re: Exclude results where two or more fields match