Getting Data In

Search with where to filter based on wildcard variable

realsplunk
Motivator

Could you let me know why the results are not filtered (I hidden sensible data) with | where NOT like (source, "%stimeyesterday%")

![alt text][1]

| tstats latest(_time) as latest,earliest(_time) as earliest WHERE (index=* AND ...) by host source sourcetype | eval lastevent=strftime(latest, "%Y-%m-%d %H:%M") | eval firstevent=strftime(earliest, "%Y-%m-%d %H:%M")
... | eval timeYesterday=round(relative_time(now(), "-1d@d"))| eval stimeyesterday=strftime(timeYesterday, "%Y-%m-%d") | eval timeRelative=round(relative_time(now(), "@d")) | where latest < timeRelative | eval resultat=if(latest < timeRelative,"KO","OK") | eval stimerel=strftime(timeRelative, "%Y-%m-%d %H:%M") | sort host | fields - latest earliest timeRelative timeYesterdayss | where NOT like(source,"%stimeyesterday%")

0 Karma

realsplunk
Motivator

Solved by support :

| where NOT like(source,stimeyesterday)
So, in your query, you can use something like, to add the %% around the filter string beforehand:
| eval stimeyesterday="%".strftime(timeYesterday, "%Y-%m-%d")."%"

0 Karma

mayurr98
SplunkTrust
SplunkTrust

hey @realsplunk, I do not know what you are trying to achieve you want to filter out source which has stimeyesterday keyword? then

instead of | where NOT like(source,"%stimeyesterday%") use | search NOT source=*stimeyesterday*

let me know if this helps!

0 Karma

realsplunk
Motivator

No, 2018-01-21 logs still there 😞

0 Karma

mayurr98
SplunkTrust
SplunkTrust

which is the field that contains date? if you have a value in source field then only you can apply this query.
This works vertically not horizontally. pls, explain what table you got and what do you want to exclude.

0 Karma

realsplunk
Motivator
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.