Remove values in Field Value.

[Vigneshprasanna]

Hi ,

Can any one help me in removing the values that are tagged in field

If you see the image you can see the Total:, Source),Method), are in the field of Return_type.
here i would like to remove the values highlighted from the list of Return_type

Thanks In advance 🙂

Vignesh

[niketn]

@Vigneshprasanna, if the events with Total:, Source),Method), etc are not required ideally, you should check out how to send them to nullQueue so that they get filtered at index time rather than filtering them out during search time.

[mayurr98]

can you try this ?

index=<your_index> NOT Return_type IN ("Total:" "Source)" "Method)")

[niketn]

@Vigneshprasanna just FYI IN will work in Splunk 6.6 or higher otherwise you will have to use

<yourBaseSearch> Return_type!="Total:" AND Return_type!="Source)"  AND Return_type!="Method)" 

The additional characters colon : and end bracket ), makes me think you need to re-consider your Field Extraction for Return_type. Community would be able to assist with this however, you would need to provide us with sample events for each (after masking/anonymizing any sensitive data).