Archive

I need to exclude eventID 1058 but only when the host is ServerA or ServerB

New Member

I need to exclude eventID 1058 but only when the host is ServerA or ServerB if its ServerC then I still want to see the event.

I tried NOT (EventID=1058 AND Server=ServerA OR Server=ServerB)

But this is not working as desired.

0 Karma

Communicator

I tried this with some of my data and this may be a solution for you. The AND, I believe is implied so not needed (notice the parens):

  • sourcetype= NOT EventID=1058 AND (Server=ServerA OR Server=ServerB)

Hope this helps!

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!