Getting Data In

how to filter by "does not equal"

Techfrogger
Explorer

I know how to filter for a specific event so, for example, I always run this:
source=wineventlog:* earliest_time=-24h "Type=Success"
But what I'd now like to do is the opposite: I'd like to eliminate all these "successes" so I can see all the rest. Since I don't know what the rest are, I can't filter by them. Can I do something like "type DOES NOT EQUAL Success"?

Tags (1)

Keysofsandiego
Explorer

another example

foo search ... source=WinEventLog:Security | yadda yadda yadda

or the opposite

foo search ... source!=WinEventLog:Security | yadda yadda yadda

Its not easy to understand what people are saying when you are a newb as I am.

wangweibee
Explorer

"not equal " is just "!="

Ayn
Legend
your_search Type!=Success | the_rest_of_your_search

without the quotes, otherwise Splunk will literally be looking for the string "Type!=Success". Also you might want to do NOT Type=Success instead. The reason for that is that Type!=Success implies that the field "Type" exists, but is not equal to "Success". If the "Type" field doesn't exist at all, the filtering expression will not match.

kristian_kolb
Ultra Champion

Don't be so humble. Converted it to an answer for you 🙂

Marco
Communicator

@kristian_kolb 

LOL this comment made my day 8 years later

-Marco

0 Karma

sowings
Splunk Employee
Splunk Employee

It's possible that the only events with a 'Type' field defined are those where Type=Success. If that's true, then the third search (with !=) would have no field 'Type' against which to evaluate = or even !=.

Also consider absolute time frames, so that the time at which the search is executed isn't leading to different answers. Consider "yesterday" -> earliest=-1d@d latest=@d

0 Karma

Techfrogger
Explorer

So why is that when I search on
source=wineventlog:* earliest_time=-24h
I get approximately 25,000 responses and when I search on
source=wineventlog:* earliest_time=-24h "Type=Success"
I get approximately 24,000
But when I then search on
source=wineventlog:* earliest_time=-24h "Type!=Success"
I get zero responses? I should get back approximately 1,000 responses. What am I doing wrong?

0 Karma

sowings
Splunk Employee
Splunk Employee

It's as simple as "Type!=Success".

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!