topic Splunk - excluding fields which contain certain values in Splunk Search

Splunk - excluding fields which contain certain values

nickhaj — Thu, 04 Jul 2019 11:25:54 GMT

I want to exclude events within my search which have a field (Message) which may contain certain values;
so my Search is currently :
index=a OR index=b SourceName=a OR sourcetype =a ERROR OR FAIL OR FAILED OR FAILURE
| where NOT (Action="Fail.") AND NOT (Message=getservbyname) AND NOT (Message=UDP)

The above doesnt work obviously, but the first bit (Action="Fail.") exclusion works OK on its own; so I'm looking for the syntax which will make the Message field includes values 'getservbyname' OR 'UDP' exclusions work too. The "Message" field is a long text field hence trying to filter these out using Key Values getservbyname and UDP.

Many Thanks for any assistance!

Re: Splunk - excluding fields which contain certain values

FrankVl — Thu, 04 Jul 2019 12:16:43 GMT

try:

(index=a OR index=b) (SourceName=a OR sourcetype =a) (ERROR OR FAIL OR FAILED OR FAILURE) Action!="FAIL." Message!=*getservbyname* Message!=*UDP*

Note: I just added those parentheses to make it a little easier to read, those are not necessary.
Note2: this will only show results that do have some value in Action and Message field. If you also want to include events where those fields are empty, then use NOT Action="Fail." NOT Message=*getservbyname* NOT Message=*UDP* instead of the != operator.

Re: Splunk - excluding fields which contain certain values

nickhaj — Thu, 04 Jul 2019 13:38:26 GMT

HI - that seems to have done the trick !!! MANY Thanks for your input !

Re: Splunk - excluding fields which contain certain values

FrankVl — Thu, 04 Jul 2019 13:58:28 GMT

Assuming that comment belongs to my answer: you're welcome. Please mark the answer as accepted, so it is clear your question has been answered 🙂

Re: Splunk - excluding fields which contain certain values

nickhaj — Thu, 04 Jul 2019 14:22:02 GMT

I did some tests adding one of the NOT statements at a time and the amount of events returned reduced accordingly each time, so i'm 99.99% sure the revisions suggested are doing the job.....but will monitor over the next week to be 100% certain 🙂