topic Re: filter a table result in Splunk Search

filter a table result

trifledalliance — Fri, 20 Oct 2023 14:56:42 GMT

Hi - i'm not great at Splunk and am struggling with this one:

I have this search result in table form

I'd like to filter out any servers that have status deleted so for the example i'd like

Thanks for any help.

richgalloway — Fri, 20 Oct 2023 15:14:08 GMT

Using just the where command to filter results just removes one Server1 event rather than all of them.

Instead, you can use the eventstats command to associated the Deleted status with all events from the same server. Then filter on that association.

| eventstats count(eval(Status="Deleted")) as is_deleted by Name | where is_deleted=1 | fields - is_deleted

trifledalliance — Tue, 24 Oct 2023 08:48:08 GMT

That works nicely thanks @richgalloway I just had to tweak the where to get the list of undeleted.

| eventstats count(eval(Status="Deleted")) as is_deleted by Name
| where is_deleted=0 | table Name is_deleted Status