Dashboards & Visualizations

How to not include particular source in Splunk query

aditsss
Motivator

Hi Team,

I am creating one Splunk query as below:

index="600000304_d_gridgain_idx*" sourcetype=600000304_gg_abs_ipc2  source="/app/abs-upstreamer/logs/abs-upstreamer.log"

I am getting events from another which I don't want to be included in my query

I don't want this particular source ="/var/app" to be included in my query.

Please guide how can I exclude that from my query

 

Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @aditsss,

if in your main search you have the condition source="/app/abs-upstreamer/logs/abs-upstreamer.log", you cannot have events with source="/var/log/*".

Maybe is the "/var/log" in another field?

Ciao.

Giuseppe

0 Karma

aditsss
Motivator

@gcusello 

Thanks for update

I am getting events from two source

1)source="/app/abs-upstreamer/logs/abs-upstreamer.log"

2) source ="/var/log"

I want my query like this from which I don't want events from source ="/var/log"

currently I am not using any source:

index="600000304_d_gridgain_idx*" sourcetype=600000304_gg_abs_ipc2  "Total msg processed for trim reage file:"

I am getting events from both the sources but I don't want event from this source ="/var/log"

Could you guide me on this

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index="600000304_d_gridgain_idx*" sourcetype=600000304_gg_abs_ipc2  "Total msg processed for trim reage file:" source="/app/abs-upstreamer/logs/abs-upstreamer.log"
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @aditsss,

if you have two sources, I hint to use the source you want in the main search, because a positive filter is always more efficient than a negative one.

If you could have more sources and you want to exclude someone, you can use

index="600000304_d_gridgain_idx*" sourcetype=600000304_gg_abs_ipc2  "Total msg processed for trim reage file:" source!="/var/log/*"

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...