Building for the Splunk Platform

Match and Exclude Specific Values in a Dynamic Field


Greetings Splunkers,

I'm attempting to create a dashboard panel that creates a count of "Roles" by Role_Names, however, I need to exclude specific field values from a dynamic field labeled "Roles" based on the Role_Name.

For example, if I have Role_Name=Security AND Roles=A, B, C, D, I want to exclude all those "Roles" for that specific "Role_Name and return a count value of "0". However, today, the "Roles" for Role_Name=Security can equal A, B, C, & D but next week it might equal A, B, & F, in this case, I'd want to still exclude A & B but count F.

Additionally, Roles can be associated with other Role_Names so I can't just exclude them from the search altogether. I know there's a way to accomplish this I just can't recall it. Any assistance is greatly appreciated.

0 Karma


I was able to find the answer with the assistance of a colleague. After running a stats command to correlate the data based on specific prerequisites, I did the following:

| mvexpand Roles
| search NOT (Role_Name=Security (Roles=A OR Role=B OR etc))
| stats values(blah) as blah count(Roles) as Role_Count by Role_Name

This provided me with my desired outcome and keeps my "Role_Count" flexible for that particular Role_Name. Hope this helps someone else down the line as well.

0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...