How to make Filters on extracted fields ?

[isedrof]

Hey everybody,

i asked a question before and thanks to "Mus"(member here) i got an answer and it works .
http://answers.splunk.com/answers/265963/how-to-compare-two-log-files.html#answer-267398

And now what i should to do is to make filter on the fields extracted.
So, i want to put a filter on the "user_name" So that we extarct those that does not start with "WS" for example, and filter "sing_in_date<08/07/2015 " .. how we can do that ?

Thanks again.

[vinitatsky · Accepted solution]

To filter out search results - you can do it in couple of ways
1) Use AND NOT in your search criteria i.e AND NOT user_name=WS*
2) To filter out sign_in_date - you can use where cause
http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/CommonEvalFunctions