Is there a way to express a series of exclude filters as variable in a search?
What I want to do is create a search and eventually an alert that will trigger on all Event Log Warnings and Errors until I exclude them one by one in the search. I realize the search string would grow impossibly long so I want to know if there is a way to condense the excluded filters and represent them with a single constant or variable that would be updated and vetted on an ongoing basis.
Having this type of search would only yield events that I don't yet know about that could be important for me to investigate while at the same time filter out events I already know about and can safely ignore.
I'm open to other alternatives but this is basically the impetus of what I want to accomplish.
You could use a macro and update it over time as you add various known filters. That would simplify your search string.
You could use a macro and update it over time as you add various known filters. That would simplify your search string.
It looks like it's not about the number of characters. Take a look.
http://splunk-base.splunk.com/answers/8399/what-is-the-max-character-limit-for-a-macro
Sounds like an excellent solution. Do you know if there is a character limit in a Macro? If so, I imagine at some point I would need to string them together in series.