topic Re: Excluding one user name from search in Splunk Search

Excluding one user name from search

robK123 — Fri, 28 Dec 2012 13:58:23 GMT

I have this search:

(index=infrastructure-os OR index=main) sudo "incorrect password attempt*" |rex field=_raw "sudo:[^a-z]+(?[^ ]+) : (?[0-9]+) incorrect"|stats sum(failures) by user, host

But I am unsure how to exclude one user called addmm from the results as I do not want to see that one.

Thanks,

Re: Excluding one user name from search

jangid — Fri, 28 Dec 2012 14:27:08 GMT

try
NOT user="addmm"

Re: Excluding one user name from search

robK123 — Fri, 28 Dec 2012 14:41:01 GMT

I tried:

(index=infrastructure-os OR index=main) sudo "incorrect password attempt*" |rex field=_raw "sudo:[^a-z]+(?[^ ]+) : (?[0-9]+) incorrect"|stats sum(failures) by user, host NOT user="addm"

but get the following error when I try:

Error in 'stats' command: The argument 'user=addm' is invalid.

Re: Excluding one user name from search

jonuwz — Fri, 28 Dec 2012 16:05:11 GMT

There's 2 ways to filter out the user.
append either :

| search NOT user="addm"

| where user!="addm"

Re: Excluding one user name from search

robK123 — Fri, 28 Dec 2012 16:43:36 GMT

That worked perfectly thank you!