Alerting

how to exclude some index results

rhayle
Path Finder

If you want to get all the indexes, do this:
eventcount index=* summarize=false

How do I exclude summary, history and main from my index results?
Thanks

0 Karma
1 Solution

somesoni2
Revered Legend

This works for me.

| eventcount summarize=false index=* index=_* | search NOT (index=main OR index=summary OR index=history)

View solution in original post

somesoni2
Revered Legend

This works for me.

| eventcount summarize=false index=* index=_* | search NOT (index=main OR index=summary OR index=history)

rhayle
Path Finder

Thanks, this is what I wanted.

| eventcount summarize=false index=* | search NOT (index=main OR index=summary OR index=history)

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try 'eventcount index=* summarize=false NOT (index=main OR index=summary OR index=history)'

---
If this reply helps you, an upvote would be appreciated.
0 Karma

rhayle
Path Finder

I have try these out as a search and they do not work. Am I missing something?

| eventcount index=* NOT index=main NOT index=history NOT sourcetype=stash summarize=false

| eventcount index=* summarize=false NOT (index=main OR index=summary OR index=history)

0 Karma

yannK
Splunk Employee
Splunk Employee

if you want to search but exclude "exclude summary, history and main"

try
index=* NOT index=main NOT index=history NOT sourcetype=stash

and if you want the internal indexes, add
index=* OR index=_* NOT index=main NOT index=history NOT sourcetype=stash

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>