Splunk Enterprise

Remove values in Field Value.

Vigneshprasanna
Explorer

Hi ,

Can any one help me in removing the values that are tagged in field
alt text

If you see the image you can see the Total:, Source),Method), are in the field of Return_type.
here i would like to remove the values highlighted from the list of Return_type

Thanks In advance 🙂

Vignesh

0 Karma

niketn
Legend

@Vigneshprasanna, if the events with Total:, Source),Method), etc are not required ideally, you should check out how to send them to nullQueue so that they get filtered at index time rather than filtering them out during search time.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

mayurr98
Super Champion

can you try this ?

index=<your_index> NOT Return_type IN ("Total:" "Source)" "Method)")
0 Karma

niketn
Legend

@Vigneshprasanna just FYI IN will work in Splunk 6.6 or higher otherwise you will have to use

<yourBaseSearch> Return_type!="Total:" AND Return_type!="Source)"  AND Return_type!="Method)" 

The additional characters colon : and end bracket ), makes me think you need to re-consider your Field Extraction for Return_type. Community would be able to assist with this however, you would need to provide us with sample events for each (after masking/anonymizing any sensitive data).

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...