topic Re: remove URL from search result is not working in Splunk Search

remove URL from search result is not working

jw44250 — Sat, 10 Jun 2017 20:48:30 GMT

My Splunk Query

index= index1 sourceType=source1 "Error" OR requestURl != "/test/abc" OR requestURI != "/person" OR requestURI != "error.php"

but still im getting the requestURI in my search result.

Im intersted in those events that have error .

Re: remove URL from search result is not working

richgalloway — Sat, 10 Jun 2017 22:23:23 GMT

Every error message will match your query because they will all pass at least one of the requestURI tests. Try this query instead. It will display all errors except those from "/test/abc", "/person", and "error.php".

index= index1 sourceType=source1 "Error" (requestURl != "/test/abc" AND requestURI != "/person" AND requestURI != "*error.php")

Re: remove URL from search result is not working

woodcock — Mon, 12 Jun 2017 02:45:43 GMT

LIke this:

index="index1" sourceType="source1" Error AND NOT (requestURl="/test/abc" OR requestURI="/person" OR requestURI="error.php")

Re: remove URL from search result is not working

jw44250 — Fri, 16 Jun 2017 00:59:18 GMT

Thank you

Re: remove URL from search result is not working

jw44250 — Fri, 16 Jun 2017 00:59:28 GMT

Thank you