topic ignoring extracted value in Splunk Search

ignoring extracted value

sumitnagal — Sun, 04 Sep 2011 17:45:24 GMT

I want to ignore certain search results from by search. Now one way is below where I can filter the extracted value, which I am using currently. This is not the great solution though, as I already have around 6-7 filter in search command. Now adding more will create a big problem for me. as every time i need to add using new pipe.

some search string | eval puserid = mvfilter(puserid != 211930670 ) | eval puserid = mvfilter(puserid != 212327191 ) | eval puserid = mvfilter(puserid != 211896322 ) | eval puserid = mvfilter(puserid != 212327208 | stats

somehow this is working fine, till I come to another use case where I need to ignore these values on daily basis. Now I have created n searches and on top of that a Dashboard. going modifying one by one is time consuming. Also, that is not viable solution. I am looking for a solution, where I can pass information which can be ignored from extracted results and I need not to modify my searches.

Re: ignoring extracted value

araitz — Sun, 04 Sep 2011 18:58:34 GMT

I'm not sure I understand why your are using eval as such, as it is suboptimal. As a rule of thumb, filtering should be performed before the first pipe symbol.

some search string NOT puserid=211930670 NOT puserid=212327191 ... | stats ...

A more efficient solution would be to use a lookup or eventtypes and tags to manage the list of puserid that you want to exclude.

Re: ignoring extracted value

sumitnagal — Tue, 06 Sep 2011 13:36:01 GMT

the only problem is I am getting puserid from a search string, hence I am thinking of using like this way

let me know, if there are better ways to do so.

Also, in your suggestion every time I need to add puserid, which I want to ignore in my use case.

Re: ignoring extracted value

sumitnagal — Wed, 07 Sep 2011 14:26:27 GMT

I have used lookup which has solved the problem, but now everytime I need to update lookup.csv file. Currently I am deleting existing lookup file and uploading new lookup file with values.