How to not include particular source in Splunk query

[aditsss]

Hi Team,

I am creating one Splunk query as below:

index="600000304_d_gridgain_idx*" sourcetype=600000304_gg_abs_ipc2  source="/app/abs-upstreamer/logs/abs-upstreamer.log"

I am getting events from another which I don't want to be included in my query

I don't want this particular source ="/var/app" to be included in my query.

Please guide how can I exclude that from my query

[gcusello]

Hi @aditsss,

if in your main search you have the condition source="/app/abs-upstreamer/logs/abs-upstreamer.log", you cannot have events with source="/var/log/*".

Maybe is the "/var/log" in another field?

Ciao.

Giuseppe

[aditsss]

@gcusello 

Thanks for update

I am getting events from two source

1)source="/app/abs-upstreamer/logs/abs-upstreamer.log"

2) source ="/var/log"

I want my query like this from which I don't want events from source ="/var/log"

currently I am not using any source:

index="600000304_d_gridgain_idx*" sourcetype=600000304_gg_abs_ipc2  "Total msg processed for trim reage file:"

I am getting events from both the sources but I don't want event from this source ="/var/log"

Could you guide me on this

[ITWhisperer]

index="600000304_d_gridgain_idx*" sourcetype=600000304_gg_abs_ipc2  "Total msg processed for trim reage file:" source="/app/abs-upstreamer/logs/abs-upstreamer.log"

[gcusello]

Hi @aditsss,

if you have two sources, I hint to use the source you want in the main search, because a positive filter is always more efficient than a negative one.

If you could have more sources and you want to exclude someone, you can use

index="600000304_d_gridgain_idx*" sourcetype=600000304_gg_abs_ipc2  "Total msg processed for trim reage file:" source!="/var/log/*"

Ciao.

Giuseppe