Splunk Search

How to remove specified values of a field from a table?

ganinurceski
Engager

Hello there!
I need some help. I have a table, and in that table, there are are a "SHORT_ID", "DATA1 -> ERROR" & "DATA2 -> NO_ERROR" Row. Now I want to remove all results, where the DATA1 Field has a value of 0, zero.

The String look like this...
index= tag= DATA="000000108000000400000058" OR "000000198000000400000000000*" | rex field=DATA "(?P"000000108000000400000058")" | rex field=DATA "(?P"000000198000000400000000")" | chart count by SHORT_ID, ERROR | rename 000000108000000400000058 as ERROR | sort - ERROR | rename NULL as NO_ERROR*

I want to remove every Value of NO_ERROR which has zero in it.
I hope the question is clear 🙂
Thx for response

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If I understand the question correctly, you need to add | where ERROR!=0 to the end of your query.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If I understand the question correctly, you need to add | where ERROR!=0 to the end of your query.

---
If this reply helps you, Karma would be appreciated.
0 Karma

ganinurceski
Engager

Thx for response!
I've added | search NOT ERROR="0" and it worked!

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ganinurceski

Can you please share some sample data & expected output?

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...