https://community.splunk.com/t5/Splunk-Search/search-query/m-p/33693#M7175 <P>What is wrong with the following?</P> <P>index="app" | top productName NOT productName = "Not Specified"</P> <P>I want to extract a list of product names but I don't want to include "Not Specified" as part of the set.</P> <P>TIA</P> Thu, 23 Jun 2011 18:10:31 GMT DTERM 2011-06-23T18:10:31Z https://community.splunk.com/t5/Splunk-Search/search-query/m-p/33693#M7175 <P>What is wrong with the following?</P> <P>index="app" | top productName NOT productName = "Not Specified"</P> <P>I want to extract a list of product names but I don't want to include "Not Specified" as part of the set.</P> <P>TIA</P> Thu, 23 Jun 2011 18:10:31 GMT https://community.splunk.com/t5/Splunk-Search/search-query/m-p/33693#M7175 DTERM 2011-06-23T18:10:31Z https://community.splunk.com/t5/Splunk-Search/search-query/m-p/33694#M7176 <P>Try excluding "not specified" in the original search string, before calling the top command. Also, use !=</P> <PRE><CODE>index="app" productName!="Not Specified" | top productName </CODE></PRE> Thu, 23 Jun 2011 18:24:06 GMT https://community.splunk.com/t5/Splunk-Search/search-query/m-p/33694#M7176 sfleming 2011-06-23T18:24:06Z