https://community.splunk.com/t5/Splunk-Search/Splunk-query-to-filter-results/m-p/263588#M175783 <P>Couple of options below.</P> <P>Specify the 5 servers directly with an OR:</P> <PRE><CODE>index=foo sourcetype=bar (host=host1 OR host=host2 OR host=host3 OR host=host4 OR host=host5) </CODE></PRE> <P>Assuming your sourcetype/index contains data that refers to those 6 hosts and only those you can do a "return all but this one":</P> <PRE><CODE> index=foo sourcetype=bar host!=hostIdontwanttosee </CODE></PRE> Mon, 30 Jan 2017 09:40:27 GMT javiergn 2017-01-30T09:40:27Z https://community.splunk.com/t5/Splunk-Search/Splunk-query-to-filter-results/m-p/263587#M175782 <P>I have some code deployed on 1 out of my 6 servers. I need a splunk query that pulls data from the other 5 hosts. Something like - All except this 1 host. I know the host option in splunk to look for the host's logs, but I have no idea how to do all except 1. Can someone please assist me?</P> <P>The one box I am talking about has my latest code changes, and the other 5 have my old code. So I want to write a query to do a before vs after analysis.</P> Mon, 30 Jan 2017 09:33:28 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-query-to-filter-results/m-p/263587#M175782 tejaswiniul 2017-01-30T09:33:28Z https://community.splunk.com/t5/Splunk-Search/Splunk-query-to-filter-results/m-p/263588#M175783 <P>Couple of options below.</P> <P>Specify the 5 servers directly with an OR:</P> <PRE><CODE>index=foo sourcetype=bar (host=host1 OR host=host2 OR host=host3 OR host=host4 OR host=host5) </CODE></PRE> <P>Assuming your sourcetype/index contains data that refers to those 6 hosts and only those you can do a "return all but this one":</P> <PRE><CODE> index=foo sourcetype=bar host!=hostIdontwanttosee </CODE></PRE> Mon, 30 Jan 2017 09:40:27 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-query-to-filter-results/m-p/263588#M175783 javiergn 2017-01-30T09:40:27Z