Splunk Dev

don't show rows with specific column values

zacksoft
Contributor

| base search
table amount, currency , received, time

The value of 'received' field is either 0 or 1.

I want my table to show rows where the value of column 'received' is '1'.

Tags (1)
0 Karma
1 Solution

deepashri_123
Motivator

Hey zacksoft,

Try this:
| base search
table amount, currency , received, time | search received = "1"

Let me know if this helps!!

View solution in original post

0 Karma

deepashri_123
Motivator

Hey zacksoft,

Try this:
| base search
table amount, currency , received, time | search received = "1"

Let me know if this helps!!

0 Karma

zacksoft
Contributor

This works. Thank u.
One more thing. I also want to add the condition there,
show me only the rows where "received"="1" and "currency" not equal to "dollar" or "sterling" ??

0 Karma

deepashri_123
Motivator

| base search
table amount, currency , received, time | search received = "1" AND currency!="dollar" AND currency!="sterling"

Please accept the answer if it worked!!
Thanks!!

0 Karma

zacksoft
Contributor

I think this won't work .It is checking here if all three conditions are true.
What I am looking for is received = "1" condition must be true AND Currency not equal to dollar OR Sterling OR Mac.

Hope I didn't confuse

0 Karma

deepashri_123
Motivator

try this
| base search
table amount, currency , received, time | search received = "1" AND (currency!="dollar" OR currency!="sterling" OR currency!="mac")

0 Karma

493669
Super Champion

Hi @zacksoft,
try this:

|base search|where received="1"|table amount, currency , received, time
0 Karma

493669
Super Champion

for the additional condition try this:

|base search|where received="1" AND currency!="dollar" AND currency!="sterling" |table amount, currency , received, time
0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...