topic Re: How to search not equal with multivalued? in Splunk Search

How to search not equal with multivalued?

Rithekakan — Tue, 22 Feb 2022 14:47:35 GMT

host="SPL-SH-DC" sourcetype="csv" source="****"
Severity!="Info"
Severity!="low"
Plugin_Name!="SSL Certificate with Wrong Hostname"
Plugin_Name!="Unix Operating System Unsupported Version Detection"
Plugin_Name!="SSL Self-Signed Certificate"
Plugin_Name!="SSL Certificate Cannot Be Trusted"
Port!="8089"
Port!="6502"
| table IP_Address,device_name,Plugin_Name, Severity,model, Protocol, Port, Exploit, Synopsis, Description, Solution, See_Also, CVSS_V2_Base_Score, CVE,Plugin

Thanks for your help!

Re: How to search not equal with multivalued?

ITWhisperer — Tue, 22 Feb 2022 15:11:17 GMT

What you have will search for events which are not equal to the values you are trying to exclude. What else are you asking for?

Re: How to search not equal with multivalued?

Rithekakan — Wed, 23 Feb 2022 07:49:12 GMT

The search result is correct. How ever I am looking for a short way writing not equal for the same fields and different values.
Plugin_Name!="A"
Plugin_Name!="B"
Plugin_Name!="C"
Plugin_Name!="D"

I've tried this but it not working.

Plugin_Name !IN (A,B,C,D)

Regards,

Rithekakan

Re: How to search not equal with multivalued?

ITWhisperer — Wed, 23 Feb 2022 09:05:52 GMT

NOT Plugin_Name IN (A,B,C,D)

Re: How to search not equal with multivalued?

Rithekakan — Wed, 23 Feb 2022 13:35:25 GMT

Hi ITWhisperer,

I got it now. Thanks for your help.

Regards,

Rithekakan