Archive

remove URL from search result is not working

New Member

My Splunk Query

index= index1 sourceType=source1 "Error" OR requestURl != "/test/abc" OR requestURI != "/person" OR requestURI != "error.php"

but still im getting the requestURI in my search result.

Im intersted in those events that have error .

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Every error message will match your query because they will all pass at least one of the requestURI tests. Try this query instead. It will display all errors except those from "/test/abc", "/person", and "error.php".

index= index1 sourceType=source1 "Error" (requestURl != "/test/abc" AND requestURI != "/person" AND requestURI != "*error.php")
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

Esteemed Legend

LIke this:

index="index1" sourceType="source1" Error AND NOT (requestURl="/test/abc" OR requestURI="/person" OR requestURI="error.php")
0 Karma

New Member

Thank you

0 Karma

SplunkTrust
SplunkTrust

Every error message will match your query because they will all pass at least one of the requestURI tests. Try this query instead. It will display all errors except those from "/test/abc", "/person", and "error.php".

index= index1 sourceType=source1 "Error" (requestURl != "/test/abc" AND requestURI != "/person" AND requestURI != "*error.php")
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

New Member

Thank you

0 Karma