https://community.splunk.com/t5/Splunk-Search/How-to-filter-out-one-field-events-base-on-other-field-with-two/m-p/604977#M210402 <P>The logic regarding the Port field is incorrect.&nbsp; <FONT face="courier new,courier">(Port!=8443 OR Port!=8444)</FONT> will not exclude anything because every port number is either not 8443 or not 8444.&nbsp; Perhaps&nbsp;<FONT face="courier new,courier">(Port!=8443 AND Port!=8444)</FONT> is what was intended?&nbsp; Another way to write it is <FONT face="courier new,courier">NOT (Port=8443 OR Port=8444)</FONT></P> Fri, 08 Jul 2022 16:50:17 GMT richgalloway 2022-07-08T16:50:17Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-out-one-field-events-base-on-other-field-with-two/m-p/604971#M210401 <P>Hi All,<BR />I have this report&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Rithekakan_2-1657294246159.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/20464iA48F73297CAFD7E9/image-size/medium?v=v2&amp;px=400" role="button" title="Rithekakan_2-1657294246159.png" alt="Rithekakan_2-1657294246159.png" /></span></P> <P>&nbsp;</P> <P>My requirement is only show in table those event that do not have the Plugin Name = "TLS Version 1.1 Protocol Deprecated"&nbsp; with the Port= 8443 OR =8444 as I have&nbsp;fill color with yellow. But, still keep show the event&nbsp; that have Plugin Name = "TLS Version 1.1 Protocol Deprecated " with other Port exclude Port 8443 OR 8444.<BR />I am using below search</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Rithekakan_3-1657294973102.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/20465iAF49D9C12DD8E6B9/image-size/medium?v=v2&amp;px=400" role="button" title="Rithekakan_3-1657294973102.png" alt="Rithekakan_3-1657294973102.png" /></span></P> <P>and the result <U><STRONG>show only</STRONG></U>&nbsp;Plugin Name = "TLS Version 1.1 Protocol Deprecated " with other port exclude Port 8443 OR 8444.<BR />I want a result show all Plugin Name...... exclude&nbsp;Plugin Name = "TLS Version 1.1 Protocol Deprecated"&nbsp; that have&nbsp; Port= 8443 OR =8444<BR /><SPAN>Any suggestions?</SPAN></P> Fri, 08 Jul 2022 16:21:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-out-one-field-events-base-on-other-field-with-two/m-p/604971#M210401 Rithekakan 2022-07-08T16:21:26Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-out-one-field-events-base-on-other-field-with-two/m-p/604977#M210402 <P>The logic regarding the Port field is incorrect.&nbsp; <FONT face="courier new,courier">(Port!=8443 OR Port!=8444)</FONT> will not exclude anything because every port number is either not 8443 or not 8444.&nbsp; Perhaps&nbsp;<FONT face="courier new,courier">(Port!=8443 AND Port!=8444)</FONT> is what was intended?&nbsp; Another way to write it is <FONT face="courier new,courier">NOT (Port=8443 OR Port=8444)</FONT></P> Fri, 08 Jul 2022 16:50:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-out-one-field-events-base-on-other-field-with-two/m-p/604977#M210402 richgalloway 2022-07-08T16:50:17Z