Getting Data In

Only Filtering for Interesting Event Logs

wbordeau
Explorer

Is there a way to express a series of exclude filters as variable in a search?

What I want to do is create a search and eventually an alert that will trigger on all Event Log Warnings and Errors until I exclude them one by one in the search. I realize the search string would grow impossibly long so I want to know if there is a way to condense the excluded filters and represent them with a single constant or variable that would be updated and vetted on an ongoing basis.

Having this type of search would only yield events that I don't yet know about that could be important for me to investigate while at the same time filter out events I already know about and can safely ignore.

I'm open to other alternatives but this is basically the impetus of what I want to accomplish.

0 Karma
1 Solution

sdaniels
Splunk Employee
Splunk Employee

You could use a macro and update it over time as you add various known filters. That would simplify your search string.

http://docs.splunk.com/Documentation/Splunk/5.0/Search/Usesearchmacros#Create_search_macros_in_Splun...

View solution in original post

0 Karma

sdaniels
Splunk Employee
Splunk Employee

You could use a macro and update it over time as you add various known filters. That would simplify your search string.

http://docs.splunk.com/Documentation/Splunk/5.0/Search/Usesearchmacros#Create_search_macros_in_Splun...

0 Karma

sdaniels
Splunk Employee
Splunk Employee

It looks like it's not about the number of characters. Take a look.
http://splunk-base.splunk.com/answers/8399/what-is-the-max-character-limit-for-a-macro

0 Karma

wbordeau
Explorer

Sounds like an excellent solution. Do you know if there is a character limit in a Macro? If so, I imagine at some point I would need to string them together in series.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...