https://community.splunk.com/t5/Splunk-Search/How-to-query-for-specific-string-literal-field/m-p/153824#M185642 <P>I have a filed in my logs "labeDatal" and I also have another field that I trace out called "labelDataSpec"</P> <P>i.e. log =&gt; ".....labelData="whatever1" labelDataSpec="whatever1.1"</P> <P>How can I run a query that just brings back data for labelData and not labelDataSpec? The following query is bringing back data for labelDataSpec as well (I only want labelData):</P> <P>source=...labelData| chart count by labelData | sort count | reverse</P> <P>output example:</P> <P>labelData count<BR /> 1 whatever1 15<BR /> 2 whatever2 100<BR /> <HOWEVER></HOWEVER></P> <P>etc,...</P> Mon, 17 Feb 2014 22:34:24 GMT jaj 2014-02-17T22:34:24Z https://community.splunk.com/t5/Splunk-Search/How-to-query-for-specific-string-literal-field/m-p/153824#M185642 <P>I have a filed in my logs "labeDatal" and I also have another field that I trace out called "labelDataSpec"</P> <P>i.e. log =&gt; ".....labelData="whatever1" labelDataSpec="whatever1.1"</P> <P>How can I run a query that just brings back data for labelData and not labelDataSpec? The following query is bringing back data for labelDataSpec as well (I only want labelData):</P> <P>source=...labelData| chart count by labelData | sort count | reverse</P> <P>output example:</P> <P>labelData count<BR /> 1 whatever1 15<BR /> 2 whatever2 100<BR /> <HOWEVER></HOWEVER></P> <P>etc,...</P> Mon, 17 Feb 2014 22:34:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-query-for-specific-string-literal-field/m-p/153824#M185642 jaj 2014-02-17T22:34:24Z https://community.splunk.com/t5/Splunk-Search/How-to-query-for-specific-string-literal-field/m-p/153825#M185643 <P>Your stats should work like it is - have you verified your data? Anyway, you can remove the field before the stats/chart/timechart/whatever, just to be sure ...</P> <PRE><CODE>your search | fields - labelDataSpec | chart count by labelData | sort - count </CODE></PRE> <P>/K</P> Tue, 18 Feb 2014 00:20:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-query-for-specific-string-literal-field/m-p/153825#M185643 kristian_kolb 2014-02-18T00:20:48Z