topic Re: Excluding string from events in Splunk Search

How can I filter all events to exclude this string?

POR160893 — Mon, 11 Apr 2022 15:45:00 GMT

Hi,

I have an index of log events and I have been asked to exclude all events with a certain string in it. The String I need to omit is drminprtmgmt.isus.emc.com. This string (which represents a device) is not mapped to any field currently. How can I filter all events to exclude this string?

This is currently what I have (which does NOT work):

Many thanks,
Patrick

Re: Excluding string from events

PickleRick — Mon, 11 Apr 2022 10:47:30 GMT

Don't use the "where" command - it's meant for boolean-evaluating conditions. Use the "search" command.

Re: Excluding string from events

gcusello — Mon, 11 Apr 2022 11:44:01 GMT

Hi @POR160893,

as @PickleRick said, you have to use the search command or (better) put the string to exclude in the main search, something like this:

index=ironport sourcetype=cisco:wsa:squid NOT drminprtmgmt.isus.emc.com

Ciao.

Giuseppe

Re: Excluding string from events

POR160893 — Mon, 11 Apr 2022 13:25:22 GMT

This worked perfectly, thanks! 😁

Re: Excluding string from events

gcusello — Mon, 11 Apr 2022 13:32:22 GMT

Hi @POR160893 ,

good for you, if this answer solves your need, please accept it or the other people of Community, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉