https://community.splunk.com/t5/Splunk-Search/How-to-exclude-a-hyphen-quot-quot-field-value-from-my-search/m-p/128966#M35048 <P>When running this search: </P> <PRE><CODE>index=syslog | stats count by UserAgent </CODE></PRE> <P>it gives me <CODE>-</CODE> and a whole bunch of other User Agents. Some of the logs do not have User Agent, so they have <CODE>-</CODE> instead. I just want to exclude this from the result. </P> <P>I tried: </P> <PRE><CODE>index=syslog UserAgent!="-" | stats count by UserAgent index=syslog UserAgent!=- | stats count by UserAgent index=syslog NOT UserAgent=- | stats count by UserAgent index=syslog NOT UserAgent="-" | stats count by UserAgent </CODE></PRE> <P>No luck. Any help will be appreciated, thank you. </P> Tue, 07 Apr 2015 02:46:46 GMT dineshp 2015-04-07T02:46:46Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-a-hyphen-quot-quot-field-value-from-my-search/m-p/128966#M35048 <P>When running this search: </P> <PRE><CODE>index=syslog | stats count by UserAgent </CODE></PRE> <P>it gives me <CODE>-</CODE> and a whole bunch of other User Agents. Some of the logs do not have User Agent, so they have <CODE>-</CODE> instead. I just want to exclude this from the result. </P> <P>I tried: </P> <PRE><CODE>index=syslog UserAgent!="-" | stats count by UserAgent index=syslog UserAgent!=- | stats count by UserAgent index=syslog NOT UserAgent=- | stats count by UserAgent index=syslog NOT UserAgent="-" | stats count by UserAgent </CODE></PRE> <P>No luck. Any help will be appreciated, thank you. </P> Tue, 07 Apr 2015 02:46:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-a-hyphen-quot-quot-field-value-from-my-search/m-p/128966#M35048 dineshp 2015-04-07T02:46:46Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-a-hyphen-quot-quot-field-value-from-my-search/m-p/128967#M35049 <P>All of those are correct if the value of the UserAgent field is indeed sometimes a hyphen.<BR /> So this suggests you've got to check yourself for assumptions.<BR /> ...|stats count by UserAgent|sort UserAgent<BR /> does that show you the hyphen up at or near the top of the list?</P> Tue, 07 Apr 2015 03:11:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-a-hyphen-quot-quot-field-value-from-my-search/m-p/128967#M35049 rsennett_splunk 2015-04-07T03:11:53Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-a-hyphen-quot-quot-field-value-from-my-search/m-p/128968#M35050 <P>I know what you are saying, when i run .....|stats count by UserAgent|sort UserAgent<BR /> "-" is always on the top with highest number of count. </P> Tue, 07 Apr 2015 03:23:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-a-hyphen-quot-quot-field-value-from-my-search/m-p/128968#M35050 dineshp 2015-04-07T03:23:25Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-a-hyphen-quot-quot-field-value-from-my-search/m-p/128969#M35051 <P>okidoke... now you have to start doubting your eyes... try <CODE>"*-*"</CODE> maybe there are control characters in there? maybe post a couple of events with your question. perhaps there's something off that another pair of eyeballs will see.</P> Tue, 07 Apr 2015 03:44:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-a-hyphen-quot-quot-field-value-from-my-search/m-p/128969#M35051 rsennett_splunk 2015-04-07T03:44:43Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-a-hyphen-quot-quot-field-value-from-my-search/m-p/128970#M35052 <P>In your results, if you hold the ALT key, and click on the "-" in the UserAgent column, does the drill-down search properly exclude it? If it does, copy the syntax that Splunk used to exclude it into your original search.</P> Tue, 07 Apr 2015 15:09:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-a-hyphen-quot-quot-field-value-from-my-search/m-p/128970#M35052 masonmorales 2015-04-07T15:09:52Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-a-hyphen-quot-quot-field-value-from-my-search/m-p/128971#M35053 <P>Oh... Very good idea!</P> Tue, 07 Apr 2015 15:22:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-a-hyphen-quot-quot-field-value-from-my-search/m-p/128971#M35053 rsennett_splunk 2015-04-07T15:22:58Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-a-hyphen-quot-quot-field-value-from-my-search/m-p/128972#M35054 <P>If this worked, please choose "Accept Answer"</P> Tue, 07 Apr 2015 16:10:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-a-hyphen-quot-quot-field-value-from-my-search/m-p/128972#M35054 masonmorales 2015-04-07T16:10:43Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-a-hyphen-quot-quot-field-value-from-my-search/m-p/128973#M35055 <P>Naa.. That didnt work. when i press "Alt" and its came up as NOT - . <BR /> This resulted lesser search result. </P> Tue, 07 Apr 2015 21:40:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-a-hyphen-quot-quot-field-value-from-my-search/m-p/128973#M35055 dineshp 2015-04-07T21:40:08Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-a-hyphen-quot-quot-field-value-from-my-search/m-p/128974#M35056 <P>This works, but i think its excluding something else as well.. Not just the UserAgent field. </P> Tue, 07 Apr 2015 21:40:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-a-hyphen-quot-quot-field-value-from-my-search/m-p/128974#M35056 dineshp 2015-04-07T21:40:35Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-a-hyphen-quot-quot-field-value-from-my-search/m-p/128975#M35057 <P>What version of Splunk are you using? If it's current... clicking on the hyphen when you just list out the data should give you a popup with the option to list the events filtered by what you're clicking on. That should show you what Splunk is seeing...</P> Tue, 07 Apr 2015 22:23:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-a-hyphen-quot-quot-field-value-from-my-search/m-p/128975#M35057 rsennett_splunk 2015-04-07T22:23:17Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-a-hyphen-quot-quot-field-value-from-my-search/m-p/128976#M35058 <P>show us a data sample please.</P> Tue, 07 Apr 2015 22:24:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-a-hyphen-quot-quot-field-value-from-my-search/m-p/128976#M35058 rsennett_splunk 2015-04-07T22:24:03Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-a-hyphen-quot-quot-field-value-from-my-search/m-p/128977#M35059 <P>I believe we are running 5.x There are no popups :'(</P> Tue, 07 Apr 2015 23:39:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-a-hyphen-quot-quot-field-value-from-my-search/m-p/128977#M35059 dineshp 2015-04-07T23:39:03Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-a-hyphen-quot-quot-field-value-from-my-search/m-p/128978#M35060 <P>You've already said that when you did alt and clicked on it, splunk appended NOT - to your search, emulate that and put it in your original search </P> <P><CODE>base search NOT - | ...</CODE></P> <P>Let us know the outcome</P> Wed, 08 Apr 2015 07:38:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-a-hyphen-quot-quot-field-value-from-my-search/m-p/128978#M35060 markthompson 2015-04-08T07:38:23Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-a-hyphen-quot-quot-field-value-from-my-search/m-p/128979#M35061 <P>No dice...it filters out everything...</P> Tue, 16 Jun 2015 19:24:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-a-hyphen-quot-quot-field-value-from-my-search/m-p/128979#M35061 autolycus 2015-06-16T19:24:22Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-a-hyphen-quot-quot-field-value-from-my-search/m-p/128980#M35062 <P>What about this?</P> <PRE><CODE>index=syslog | eval NullUserAgent=if(like(UserAgent, "-"), "True", "False") | search NullUserAgent="False" | stats count by UserAgent </CODE></PRE> <P>Or:</P> <PRE><CODE>index=syslog | rex field=UserAgent "^(?P&lt;NullUserAgent&gt;\-)$" | search NOT NullUserAgent | stats count by UserAgent </CODE></PRE> Tue, 16 Jun 2015 21:29:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-a-hyphen-quot-quot-field-value-from-my-search/m-p/128980#M35062 masonmorales 2015-06-16T21:29:36Z