topic Re: how to exclude a certain field value from results in Splunk Search

how to exclude a certain field value from results

ayenumula — Tue, 17 Jun 2014 22:13:42 GMT

Search query: list the last known user (userid) on each host.

sourcetype=syslog source=/var/log/secure "pam_unix(sshd:session)" | rex "(?i) user (?P<userid>[^ ]+)" | stats latest(userid) as userid by host, _time | dedup host

I then want to exclude a particular user "system" from the result list.

I tried the NOT and "!=" in every part of the query but not working, can you help me with the search query

Re: how to exclude a certain field value from results

alterdego — Tue, 17 Jun 2014 22:29:31 GMT

Does the value "system" appear in the filed you create? If so then you should be able to pipe your original search to the search command and exclude the "system" value with "| search userid!=system".

sourcetype=syslog source=/var/log/secure "pam_unix(sshd:session)" | rex "(?i) user (?P[^ ]+)" | stats latest(userid) as userid by host, _time | dedup host | search userid!=system

Re: how to exclude a certain field value from results

Damien_Dallimor — Tue, 17 Jun 2014 22:33:07 GMT

.. | where userid != "system" | ...

or maybe tweak your regex

(?i)\suser\s(?!system)(?P<userid>\w+)

Re: how to exclude a certain field value from results

ayenumula — Wed, 18 Jun 2014 23:00:29 GMT

Damien's answer: | where userid != "system". This worked as it included the host (row) which has "system" user but excluded "system" from the result set, it still displayed the host with other users.

I tried Alterdego's answer: "| search userid!=system". This did not work for me because it completely excluded the host (row) which contains the word "system" even thou it contains other users.

Re: how to exclude a certain field value from results

ayenumula — Wed, 18 Jun 2014 23:02:26 GMT

Is there a certain way to exclude multiple users using | where userid != "system"