topic Re: Need a help with splunk query in Splunk Search

Need a help with splunk query

jagan_vannala — Thu, 29 Aug 2024 09:49:42 GMT

HI Team,

When i am trying to exclude one field by inserting condition sessionId!=X its not working . even though I used "NOT" condition but the field which i am trying to exclude is still showing in results. could you please help how i can exclude particular field

host="*" sessionId!=X

host="*" NOT sessionId!=X

Re: Need a help with splunk query

gcusello — Thu, 29 Aug 2024 09:54:13 GMT

Hi @jagan_vannala ,

maybe it's a mistyping, but in the solution with NOT you don't need to add !, in other words:

host="*" NOT sessionId=X

Anyway, your two searchs has different results because with sessionId!=X you tale all the logs where the filed sessionId is present and hasn't the value "X",

instead with NOT sessionId=X you have all the events except the ones with sessionId=X , even if the sessionId field isn't present.

Ciao.

Giuseppe

Re: Need a help with splunk query

PaulPanther — Thu, 29 Aug 2024 09:57:41 GMT

If you only wanna see events that do not contain the field sessionId You must search as follows

host="*" NOT sessionId

Re: Need a help with splunk query

jagan_vannala — Thu, 29 Aug 2024 10:01:38 GMT

Hi ,

I would like to exclude particular session under multiple session ID's

Re: Need a help with splunk query

gcusello — Thu, 29 Aug 2024 10:06:07 GMT

Hi @jagan_vannala ,

sorry but it isn't still clear:

to exclude particular sessionId, choose the ones to exclude and put them in a condition

| search NOT sessionId IN (cond1, cond1, cond3)

Ciao.

Giuseppe

Re: Need a help with splunk query

jagan_vannala — Thu, 29 Aug 2024 10:28:07 GMT

If I want to exclude multiple fields by using NOT condition how can to use NOT query

NOT sessionId=X AND groupID=Y

Is this works? please suggest

Re: Need a help with splunk query

gcusello — Thu, 29 Aug 2024 10:34:16 GMT

Hi @jagan_vannala ,

use parenthesis:

NOT (sessionId=X groupID=Y)

and the AND boolean operator isn't required.

if you have these doubt, I hint to follow the Splink Search Tutorial, that explain how to create your searches: https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchTutorial/WelcometotheSearchTutorial

Ciao.

Giuseppe