topic Re: Exclude data from a field in Splunk Search

How to exclude data from a field?

MR1992 — Thu, 20 Apr 2023 16:48:20 GMT

Is there a way to exclude specified data from a single field. The example I have is on Destination IP addresses from a firewall.

Splunk is currently showing multiple IP addresses in the field that is the direct path from source to destination and some are related to our specific appliances that we do not need to see. e.g. I have 3 IP's as below

1.1.1.1

1.1.1.2

1.1.1.3

I know what 1.1.1.1 and 1.1.1.2 are so I need to exclude them from view on the field but I want to keep 1.1.1.3. I need my know IP's excluded as there are many others that I am not aware of. I have around 50 IP's I want excluded from the field.

Re: Exclude data from a field

ITWhisperer — Thu, 20 Apr 2023 09:04:07 GMT

From your description, I assume ip is a multivalue field (?)

| eval ip=mvfilter(ip!="1.1.1.1" AND ip!="1.1.1.2")

Re: Exclude data from a field

MR1992 — Thu, 20 Apr 2023 09:19:03 GMT

Yes that is correct we have it coming into splunk as list(dest) would this exclude or only show the stated IPs? I would want it to exclude 1.1.1.1 & 1.1.1.2 from the field just to leave 1.1.1.3 on the output

Re: Exclude data from a field

ITWhisperer — Thu, 20 Apr 2023 09:42:05 GMT

It keeps what passes the test i.e. everything that is not equal to 1.1.1.1 and not equal to 1.1.1.2

Re: Exclude data from a field

MR1992 — Thu, 20 Apr 2023 13:19:00 GMT

Yeah it working great, thank you