topic Re: Omit/filter/exclude events from a transaction in Splunk Search

Omit/filter/exclude events from a transaction

pburkholder — Wed, 01 Jun 2011 20:02:38 GMT

When I do the following search

sourcetype="access*" [ search method="POST" |fields clientip | rename clientip as query ] | transaction clientip

I get transactions that include all the requests for .css, .js, .png, etc. I'd like to remove that clutter from the transactions. Being simple-mineded, I tried:

But that didn't help. How can I exclude stuff I don't want to see within a transaction?

Thanks -- Peter

Re: Omit/filter/exclude events from a transaction

dwaddle — Wed, 01 Jun 2011 20:31:54 GMT

Hi Peter,

Filter it out before it gets into the transaction. Something like:

sourcetype="access*" [ search method="POST" |fields clientip | rename clientip as query ] 
NOT ( png OR css OR js OR ico) | transaction clientip

Re: Omit/filter/exclude events from a transaction

pburkholder — Mon, 06 Jun 2011 16:06:11 GMT

Doh! Thanks!

Re: Omit/filter/exclude events from a transaction

dwaddle — Thu, 09 Jun 2011 16:19:16 GMT

If this resolved your issue, please 'accept' the answer by clicking on the outlined check-box to the left of it. Thanks!