topic Re: Help with search in Splunk Search

Help with search

unifirst101 — Tue, 06 Oct 2020 19:11:10 GMT

Hi, I am using Splunk to grab disk drive metrics but often times I am pulling metrics for drives I don't care about. I want to exclude these from some searches, I am able to do this with a series of NOT/OR commands, as shown below, but I feel like there is an easier way with less syntax.

How can I exclude instances G thru L , in one command, without having to specify each instance as I do below?

host=vor* NOT (host="vor-pxy-prd1*" instance=G: OR instance=H: OR instance=I: OR instance=J: OR instance=K: OR instance=L:)

Thanks for any ideas -

Re: Help with search

richgalloway — Tue, 06 Oct 2020 19:59:46 GMT

There are a couple of alternatives, but neither is much better than what you have now.

Use IN

host=vor* NOT (host="vor-pxy-prd1*" instance IN ("G:", "H:", "I:", "J:", "K:", "L:")

Or use regex to filter using a regular expression

host=vor* NOT (host="vor-pxy-prd1*") | regex instance="^[GHIJKL]:"

Re: Help with search

unifirst101 — Wed, 07 Oct 2020 12:08:48 GMT

These are both great ideas and look cleaner than what I have been using - thank you!

Re: Help with search

unifirst101 — Wed, 07 Oct 2020 16:00:32 GMT

The first one worked great. I'm not able to get any results from the 2nd one even the drives I want do not show up, not sure why but I am not overly familiar with the regex side in Splunk. Thanks