Alerting

how to exclude some index results

rhayle
Path Finder

If you want to get all the indexes, do this:
eventcount index=* summarize=false

How do I exclude summary, history and main from my index results?
Thanks

0 Karma
1 Solution

somesoni2
Revered Legend

This works for me.

| eventcount summarize=false index=* index=_* | search NOT (index=main OR index=summary OR index=history)

View solution in original post

somesoni2
Revered Legend

This works for me.

| eventcount summarize=false index=* index=_* | search NOT (index=main OR index=summary OR index=history)

rhayle
Path Finder

Thanks, this is what I wanted.

| eventcount summarize=false index=* | search NOT (index=main OR index=summary OR index=history)

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try 'eventcount index=* summarize=false NOT (index=main OR index=summary OR index=history)'

---
If this reply helps you, Karma would be appreciated.
0 Karma

rhayle
Path Finder

I have try these out as a search and they do not work. Am I missing something?

| eventcount index=* NOT index=main NOT index=history NOT sourcetype=stash summarize=false

| eventcount index=* summarize=false NOT (index=main OR index=summary OR index=history)

0 Karma

yannK
Splunk Employee
Splunk Employee

if you want to search but exclude "exclude summary, history and main"

try
index=* NOT index=main NOT index=history NOT sourcetype=stash

and if you want the internal indexes, add
index=* OR index=_* NOT index=main NOT index=history NOT sourcetype=stash

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...