Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Filtering a Search
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi there, so I had a nice search return but I have a few bits that I don't want in the search. Really all I care about are the HTTP responses of 200 and I don't want to see anything with "WhatsUp/1.0" because that's just noise. Is there a good piece of documentation on this?
Trying to figure out what kind of web traffic is on a really old server that needs to be retired. Also, is there good documentation on this type of practice?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can remove events from search results by specifying filters, preferably in base search like this
index=foo sourcetype=bar http_status=200 NOT ("WhatsUp/1.0")
You can refer to Splunk search tutorial for more examples.
http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchTutorial/Usethesearchlanguage
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can remove events from search results by specifying filters, preferably in base search like this
index=foo sourcetype=bar http_status=200 NOT ("WhatsUp/1.0")
You can refer to Splunk search tutorial for more examples.
http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchTutorial/Usethesearchlanguage
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do you have to specify the source type?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Specifying more metadata field filters (index/host/source/sourcetype etc) in base search can optimize the performance.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Oh I see, it looks like status= not http_status This looks good! Thank you for the documentation!
Splunk Mobile: Your Brand-New Home Screen
Introducing Value Insights (Beta): Understand the Business Impact your organization ...
Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...
