Negate the field containing both the values in SPLUNK query

Janani_Krish — Tue, 01 Dec 2020 11:32:50 GMT

Hi,

I have written following query where a field consisting of 2 actions as below,

Query:
sourcetype="my_sourcetype" session_id="1011" |eval indicator=mvappend(src,dest)|mvexpand indicator|stats count values(action) by indicator,session_id

Result:

indicator	session_id	count	value(action)
23.45.6.78	1011	2	allowed teared
23.45.6.79	1045	2	allowed

Now I want to negate the field which contain both allowed and teared. Please suggest any ideas.

Re: Negate the field containing both the values in SPLUNK query

richgalloway — Tue, 01 Dec 2020 14:02:55 GMT

Like this, maybe?

sourcetype="my_sourcetype" session_id="1011" | eval indicator=mvappend(src,dest) | mvexpand indicator | stats count values(action) as actions by indicator,session_id | where (isnull(mvfind(actions,"allowed")) AND isnull(mvfind(actions,"teared")))

topic Re: Negate the field containing both the values in SPLUNK query in Splunk Search

Negate the field containing both the values in SPLUNK query

Re: Negate the field containing both the values in SPLUNK query