Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Filtering a Search
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi there, so I had a nice search return but I have a few bits that I don't want in the search. Really all I care about are the HTTP responses of 200 and I don't want to see anything with "WhatsUp/1.0" because that's just noise. Is there a good piece of documentation on this?
Trying to figure out what kind of web traffic is on a really old server that needs to be retired. Also, is there good documentation on this type of practice?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can remove events from search results by specifying filters, preferably in base search like this
index=foo sourcetype=bar http_status=200 NOT ("WhatsUp/1.0")
You can refer to Splunk search tutorial for more examples.
http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchTutorial/Usethesearchlanguage
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can remove events from search results by specifying filters, preferably in base search like this
index=foo sourcetype=bar http_status=200 NOT ("WhatsUp/1.0")
You can refer to Splunk search tutorial for more examples.
http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchTutorial/Usethesearchlanguage
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do you have to specify the source type?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Specifying more metadata field filters (index/host/source/sourcetype etc) in base search can optimize the performance.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Oh I see, it looks like status= not http_status This looks good! Thank you for the documentation!
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Splunk Community Badges!
How to find the worst searches in your Splunk environment and how to fix them
Share Your Feedback: On Admin Config Service (ACS)!
