Getting Data In

Exclude events with specific field value from results


How would I exclude all events which contain a specific field value from a set of search results?

For instance:
source="mysource" | sort -_time | table UserLoginName _time | dedup UserLoginName

Gives me a table of usernames and last login time.

I'd like to filter out one of the users (say, SYSTEM) from the results...

Tags (1)

Splunk Employee
Splunk Employee

You could simply add the search term "UserLoginName!=SYSTEM" or "NOT UserLoginName=SYSTEM" to the first command of your search :

source="mysource" UserLoginName!="SYSTEM" | sort -_time | table UserLoginName _time | dedup UserLoginName

If you are curious to find out more about the search language and its syntax, I recommend to consult our search tutorial :

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!