Dashboards & Visualizations

How to not include particular source in Splunk query

aditsss
Motivator

Hi Team,

I am creating one Splunk query as below:

index="600000304_d_gridgain_idx*" sourcetype=600000304_gg_abs_ipc2  source="/app/abs-upstreamer/logs/abs-upstreamer.log"

I am getting events from another which I don't want to be included in my query

I don't want this particular source ="/var/app" to be included in my query.

Please guide how can I exclude that from my query

 

Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @aditsss,

if in your main search you have the condition source="/app/abs-upstreamer/logs/abs-upstreamer.log", you cannot have events with source="/var/log/*".

Maybe is the "/var/log" in another field?

Ciao.

Giuseppe

0 Karma

aditsss
Motivator

@gcusello 

Thanks for update

I am getting events from two source

1)source="/app/abs-upstreamer/logs/abs-upstreamer.log"

2) source ="/var/log"

I want my query like this from which I don't want events from source ="/var/log"

currently I am not using any source:

index="600000304_d_gridgain_idx*" sourcetype=600000304_gg_abs_ipc2  "Total msg processed for trim reage file:"

I am getting events from both the sources but I don't want event from this source ="/var/log"

Could you guide me on this

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index="600000304_d_gridgain_idx*" sourcetype=600000304_gg_abs_ipc2  "Total msg processed for trim reage file:" source="/app/abs-upstreamer/logs/abs-upstreamer.log"
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @aditsss,

if you have two sources, I hint to use the source you want in the main search, because a positive filter is always more efficient than a negative one.

If you could have more sources and you want to exclude someone, you can use

index="600000304_d_gridgain_idx*" sourcetype=600000304_gg_abs_ipc2  "Total msg processed for trim reage file:" source!="/var/log/*"

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...