https://community.splunk.com/t5/Splunk-Search/If-then-statement-where-the-output-will-exclude-a-value-from/m-p/291375#M88043 <P>Something like below?</P> <PRE>...| eval fieldA = myEvalFunction | search NOT (fieldA=1 AND fieldB=*)</PRE> Mon, 09 Oct 2017 15:36:38 GMT pradeepkumarg 2017-10-09T15:36:38Z https://community.splunk.com/t5/Splunk-Search/If-then-statement-where-the-output-will-exclude-a-value-from/m-p/291374#M88042 <P>I want a statement that will evaluate field A, and if the value of field A equals 1, then I want to exclude any value of field B from the search.</P> Mon, 09 Oct 2017 15:27:47 GMT https://community.splunk.com/t5/Splunk-Search/If-then-statement-where-the-output-will-exclude-a-value-from/m-p/291374#M88042 jared_anderson 2017-10-09T15:27:47Z https://community.splunk.com/t5/Splunk-Search/If-then-statement-where-the-output-will-exclude-a-value-from/m-p/291375#M88043 <P>Something like below?</P> <PRE>...| eval fieldA = myEvalFunction | search NOT (fieldA=1 AND fieldB=*)</PRE> Mon, 09 Oct 2017 15:36:38 GMT https://community.splunk.com/t5/Splunk-Search/If-then-statement-where-the-output-will-exclude-a-value-from/m-p/291375#M88043 pradeepkumarg 2017-10-09T15:36:38Z https://community.splunk.com/t5/Splunk-Search/If-then-statement-where-the-output-will-exclude-a-value-from/m-p/291376#M88044 <P>So i have email events, where a series of logs have the same Message ID (MID). </P> <P>So instead of having to run:<BR /> sourcetype="email" | transaction MID | </P> <P>I want to limit the number of entries and only search against MailDirectionField=inbound. Not every event has MailDirectionField, but they do have the MID field. so I want my evaluation to state that if MailDirectionField=inbound then NOT MID associated with that event.</P> Mon, 09 Oct 2017 15:46:24 GMT https://community.splunk.com/t5/Splunk-Search/If-then-statement-where-the-output-will-exclude-a-value-from/m-p/291376#M88044 jared_anderson 2017-10-09T15:46:24Z https://community.splunk.com/t5/Splunk-Search/If-then-statement-where-the-output-will-exclude-a-value-from/m-p/291377#M88045 <P>Hi jared_anderson,<BR /> modify your main search to have only the events you want</P> <PRE><CODE>sourcetype="email" MailDirectionField=inbound | transaction MID | ... </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Mon, 09 Oct 2017 16:00:25 GMT https://community.splunk.com/t5/Splunk-Search/If-then-statement-where-the-output-will-exclude-a-value-from/m-p/291377#M88045 gcusello 2017-10-09T16:00:25Z https://community.splunk.com/t5/Splunk-Search/If-then-statement-where-the-output-will-exclude-a-value-from/m-p/291378#M88046 <P>Hi jared_anderson,<BR /> try</P> <PRE><CODE> sourcetype="email" MailDirectionField!=outbound | transaction MID | ... </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Mon, 09 Oct 2017 16:10:30 GMT https://community.splunk.com/t5/Splunk-Search/If-then-statement-where-the-output-will-exclude-a-value-from/m-p/291378#M88046 gcusello 2017-10-09T16:10:30Z https://community.splunk.com/t5/Splunk-Search/If-then-statement-where-the-output-will-exclude-a-value-from/m-p/291379#M88047 <P>the problem with that is then that will only remove one event when there are 20+ events that contain that MID.</P> <P>event1, maildirection=outbound, MID=123<BR /> event2, sourceuser=user1, MID=123<BR /> event3, destinationuser=user2, MID=123</P> <P>event1, maildirection=outbound, MID=124<BR /> event2, sourceuser=user1, MID=124<BR /> event3, destinationuser=user2, MID=124</P> <P>event1, maildirection=outbound, MID=125<BR /> event2, sourceuser=user1, MID=125<BR /> event3, destinationuser=user2, MID=125</P> <P>in that last search each event1 would not be returned, but the rest of the events with MID 123, 124 and 125 would be returned. </P> Mon, 09 Oct 2017 17:26:49 GMT https://community.splunk.com/t5/Splunk-Search/If-then-statement-where-the-output-will-exclude-a-value-from/m-p/291379#M88047 jared_anderson 2017-10-09T17:26:49Z