Splunk Enterprise Security

How do I exclude a specific field value from search results?

shiroyasha_
New Member

I'm trying to exclude a specific value from my search result, what I'm currently getting is the list of top hosts using this query

sourcetype=akamaisiem | timechart  count by httpMessage.host

From my query I'm getting all the hostnames, how do I exclude a specific value from the results?

0 Karma

renjith_nair
Legend

@shiroyasha_ ,

You can exclude the host before the timechart

 sourcetype=akamaisiem 'httpMessage.host' !="unwanted host" | timechart  count by httpMessage.host
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...