https://community.splunk.com/t5/Splunk-Search/Exclude-Hosts-In-A-Saved-Search/m-p/23043#M4057 <P>to expand on your question, do you wish to only exclude these drives if it reaches a certain threshold? Or do you mean you simply want to exclude these drives from the start?</P> <P>If it is the latter, you could just add something like "<CODE>NOT host=&lt;drive name&gt;</CODE>" (if you are using the drive as the host)</P> Mon, 28 Nov 2011 13:31:09 GMT MHibbin 2011-11-28T13:31:09Z https://community.splunk.com/t5/Splunk-Search/Exclude-Hosts-In-A-Saved-Search/m-p/23042#M4056 <P>I have a saved search that is looking at the % disk space free on each drive over a number of window server. There are three servers that are showing over a certain threshold. Is there anyway to add in an exlude syntax in the saved search to not report on these three servers.</P> Mon, 28 Nov 2011 13:27:05 GMT https://community.splunk.com/t5/Splunk-Search/Exclude-Hosts-In-A-Saved-Search/m-p/23042#M4056 itsomana 2011-11-28T13:27:05Z https://community.splunk.com/t5/Splunk-Search/Exclude-Hosts-In-A-Saved-Search/m-p/23043#M4057 <P>to expand on your question, do you wish to only exclude these drives if it reaches a certain threshold? Or do you mean you simply want to exclude these drives from the start?</P> <P>If it is the latter, you could just add something like "<CODE>NOT host=&lt;drive name&gt;</CODE>" (if you are using the drive as the host)</P> Mon, 28 Nov 2011 13:31:09 GMT https://community.splunk.com/t5/Splunk-Search/Exclude-Hosts-In-A-Saved-Search/m-p/23043#M4057 MHibbin 2011-11-28T13:31:09Z https://community.splunk.com/t5/Splunk-Search/Exclude-Hosts-In-A-Saved-Search/m-p/23044#M4058 <P>Hi, many thanks for your reply. The NOT host is working but I would like to exclude the host name along with drive letter (instance) for each server</P> <P>Below is what I see in Splunk when I run my % disk space free query: </P> <P>11/28/2011 14:54:20.073<BR /> collection="Free Disk Space E"<BR /> object=LogicalDisk<BR /> counter="% Free Space"<BR /> instance=E:<BR /> Value=45.903129070366219</P> Mon, 28 Nov 2011 15:06:40 GMT https://community.splunk.com/t5/Splunk-Search/Exclude-Hosts-In-A-Saved-Search/m-p/23044#M4058 itsomana 2011-11-28T15:06:40Z https://community.splunk.com/t5/Splunk-Search/Exclude-Hosts-In-A-Saved-Search/m-p/23045#M4059 <P>Have you done a field extraction for the "instance" field?</P> <P>Do you mean... you would like to exclude events similar to this (i.e. those from drive E)? Or you want to exclude the drive instance just from the results?</P> <P>Can you include your saved search in this thread please?</P> Mon, 28 Nov 2011 15:38:48 GMT https://community.splunk.com/t5/Splunk-Search/Exclude-Hosts-In-A-Saved-Search/m-p/23045#M4059 MHibbin 2011-11-28T15:38:48Z https://community.splunk.com/t5/Splunk-Search/Exclude-Hosts-In-A-Saved-Search/m-p/23046#M4060 <P>If you have done a field extraction on the instance, and you just want to exclude all events from that drive, you could also include a...</P> <UL> <LI>NOT instance=E: | <REST of="" search=""> (for example). </REST></LI> </UL> <P>If not you could do something like... </P> <UL> <LI>| rex field=_raw "instance=\s*(?<INSTANCE>\w*):"</INSTANCE></LI> </UL> <P>However this should be done by default (except it will include the ":"), and then add pipe to a search...</P> <UL> <LI>| rex field=_raw "instance=\s*(?<INSTANCE>\w*):" | search NOT INSTANCE=E | <REST of="" search=""></REST></INSTANCE></LI> </UL> <P>But this could be a little inefficient, preferably you would want to extract the field using IFX.</P> Mon, 28 Sep 2020 10:09:36 GMT https://community.splunk.com/t5/Splunk-Search/Exclude-Hosts-In-A-Saved-Search/m-p/23046#M4060 MHibbin 2020-09-28T10:09:36Z