Query Question

[lanmanjs55]

We have a number of alerts set up with Splunk.  One of them monitors the state of VPN's from our Cisco routers.  One of these routers has a couple of VPN's that are actually supposed to be down (until they get traffic sent over them) so we keep getting a false positive on the alert.  This is the query:

splunk query - sourcetype="cisco:ios" AND "down" 

I am VERY new to this and writing queries.  What is the syntax I need to add to this query that will ignore this one particular router?

Thank you for any Reply - 

[richgalloway · Accepted solution]

Add the name of the router to the query.

sourcetype="cisco:ios" AND "down" AND NOT host="name of router"

[lanmanjs55]

Excellent - thank you very much for the Reply.  Looks really easy but it just shows I have a lot to learn.  Much approciated.