Getting Data In

How to exclude some result

jangid
Builder

In my search result I want to exclude some result that belongs to eventtype, Is it possible ?

my search is

sourcetype=log_line

I want to exclude all result from eventtype=procinfo

Tags (1)
1 Solution

Drainy
Champion

Hows about;

sourcetype=log_line NOT eventtype=procinfo

View solution in original post

Drainy
Champion

Hows about;

sourcetype=log_line NOT eventtype=procinfo

Drainy
Champion

Theres no such thing as a stupid question! Its always quicker to ask if you aren't sure 🙂 Glad it helped

0 Karma

jangid
Builder

lol I am stupid 🙂

Thanks Drainy Splunk is really very powerful 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...