Getting Data In

Filtering a Search

heats
Explorer

Hi there, so I had a nice search return but I have a few bits that I don't want in the search. Really all I care about are the HTTP responses of 200 and I don't want to see anything with "WhatsUp/1.0" because that's just noise. Is there a good piece of documentation on this?

Trying to figure out what kind of web traffic is on a really old server that needs to be retired. Also, is there good documentation on this type of practice?

0 Karma
1 Solution

somesoni2
Revered Legend

You can remove events from search results by specifying filters, preferably in base search like this

index=foo sourcetype=bar http_status=200 NOT ("WhatsUp/1.0")

You can refer to Splunk search tutorial for more examples.
http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchTutorial/Usethesearchlanguage

View solution in original post

somesoni2
Revered Legend

You can remove events from search results by specifying filters, preferably in base search like this

index=foo sourcetype=bar http_status=200 NOT ("WhatsUp/1.0")

You can refer to Splunk search tutorial for more examples.
http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchTutorial/Usethesearchlanguage

heats
Explorer

Do you have to specify the source type?

0 Karma

somesoni2
Revered Legend

Specifying more metadata field filters (index/host/source/sourcetype etc) in base search can optimize the performance.

0 Karma

heats
Explorer

Oh I see, it looks like status= not http_status This looks good! Thank you for the documentation!

Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...