Getting Data In

how to filter by "does not equal"

Explorer

I know how to filter for a specific event so, for example, I always run this:
source=wineventlog:* earliest_time=-24h "Type=Success"
But what I'd now like to do is the opposite: I'd like to eliminate all these "successes" so I can see all the rest. Since I don't know what the rest are, I can't filter by them. Can I do something like "type DOES NOT EQUAL Success"?

Tags (1)

Path Finder

another example

foo search ... source=WinEventLog:Security | yadda yadda yadda

or the opposite

foo search ... source!=WinEventLog:Security | yadda yadda yadda

Its not easy to understand what people are saying when you are a newb as I am.

Explorer

"not equal " is just "!="

Legend
your_search Type!=Success | the_rest_of_your_search

without the quotes, otherwise Splunk will literally be looking for the string "Type!=Success". Also you might want to do NOT Type=Success instead. The reason for that is that Type!=Success implies that the field "Type" exists, but is not equal to "Success". If the "Type" field doesn't exist at all, the filtering expression will not match.

Ultra Champion

Don't be so humble. Converted it to an answer for you 🙂

Splunk Employee
Splunk Employee

It's possible that the only events with a 'Type' field defined are those where Type=Success. If that's true, then the third search (with !=) would have no field 'Type' against which to evaluate = or even !=.

Also consider absolute time frames, so that the time at which the search is executed isn't leading to different answers. Consider "yesterday" -> earliest=-1d@d latest=@d

0 Karma

Explorer

So why is that when I search on
source=wineventlog:* earliest_time=-24h
I get approximately 25,000 responses and when I search on
source=wineventlog:* earliest_time=-24h "Type=Success"
I get approximately 24,000
But when I then search on
source=wineventlog:* earliest_time=-24h "Type!=Success"
I get zero responses? I should get back approximately 1,000 responses. What am I doing wrong?

0 Karma

Splunk Employee
Splunk Employee

It's as simple as "Type!=Success".

0 Karma