https://community.splunk.com/t5/Splunk-Search/How-to-block-the-unusual-url/m-p/371776#M165122 <P>@10306629 - we do not work at your organization. We have no idea what makes you think those urls are unusual. We also have no idea what you mean by "block" - presumably you want to remove them from a search.</P> <P>Here's one way... </P> <PRE><CODE>| where NOT match(myURL,"abcd.com") AND NOT match(myURL,"ykui.com") AND NOT match(myURL,"oooss.com") </CODE></PRE> <P>That way will get rid of all events where the myURL field contains the matching characters, so it will also kill "xyzabcd.com" and "goooss.com.uk".</P> Wed, 15 Nov 2017 18:43:45 GMT DalJeanis 2017-11-15T18:43:45Z https://community.splunk.com/t5/Splunk-Search/How-to-block-the-unusual-url/m-p/371772#M165118 <P>Hi team,<BR /> I want to block unusual Url... could please suggest query for that</P> <P>Example </P> <P><A href="http://www.abcd.com">www.abcd.com</A><BR /> <A href="http://www.ykui.com">www.ykui.com</A><BR /> <A href="http://www.oooss.com">www.oooss.com</A> </P> <P>i want to stop those url </P> Wed, 15 Nov 2017 18:27:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-block-the-unusual-url/m-p/371772#M165118 10306629 2017-11-15T18:27:39Z https://community.splunk.com/t5/Splunk-Search/How-to-block-the-unusual-url/m-p/371773#M165119 <P>You need to provide more details and information on <CODE>I want to block ....</CODE> like How do you want to block them and where do you want to block them?</P> <P>cheers, MuS</P> Wed, 15 Nov 2017 18:30:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-block-the-unusual-url/m-p/371773#M165119 MuS 2017-11-15T18:30:39Z https://community.splunk.com/t5/Splunk-Search/How-to-block-the-unusual-url/m-p/371774#M165120 <P>just want to see the usual url </P> Wed, 15 Nov 2017 18:35:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-block-the-unusual-url/m-p/371774#M165120 10306629 2017-11-15T18:35:17Z https://community.splunk.com/t5/Splunk-Search/How-to-block-the-unusual-url/m-p/371775#M165121 <P>i have to write query for that </P> Wed, 15 Nov 2017 18:36:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-block-the-unusual-url/m-p/371775#M165121 10306629 2017-11-15T18:36:49Z https://community.splunk.com/t5/Splunk-Search/How-to-block-the-unusual-url/m-p/371776#M165122 <P>@10306629 - we do not work at your organization. We have no idea what makes you think those urls are unusual. We also have no idea what you mean by "block" - presumably you want to remove them from a search.</P> <P>Here's one way... </P> <PRE><CODE>| where NOT match(myURL,"abcd.com") AND NOT match(myURL,"ykui.com") AND NOT match(myURL,"oooss.com") </CODE></PRE> <P>That way will get rid of all events where the myURL field contains the matching characters, so it will also kill "xyzabcd.com" and "goooss.com.uk".</P> Wed, 15 Nov 2017 18:43:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-block-the-unusual-url/m-p/371776#M165122 DalJeanis 2017-11-15T18:43:45Z