topic Re: How can I remove a events from a search table in Splunk Search

How can I remove a events from a search table

vino06 — Tue, 29 Sep 2020 14:53:48 GMT

Hi Guys,

Good Day!

Just want to ask on how can I remove YYYYMMDD HH24:MI:SS") event on my search table. Here is my search and the result.

index=nf_index source=/appl/in_house/batch/AS*
| multikv
| stats count by "ACCESS CODE"

Re: How can I remove a events from a search table

rjthibod — Wed, 12 Jul 2017 10:28:18 GMT

You could try the simple boolean check of isint()

index=nf_index source=/appl/in_house/batch/AS*
| multikv 
| stats count by "ACCESS CODE"
| where isint("ACCESS CODE")

Re: How can I remove a events from a search table

s2_splunk — Wed, 12 Jul 2017 22:34:15 GMT

index=nf_index source=/appl/in_house/batch/AS* 
 NOT "ACCESS CODE"="YYYYMMDD*"
| multikv 
| stats count by "ACCESS CODE"

Or you could fix your data onboarding and don't index those events, because it seems these values are the result of something that is parsed incorrectly.