Splunk Enterprise

Remove values in Field Value.

Hi ,

Can any one help me in removing the values that are tagged in field
alt text

If you see the image you can see the Total:, Source),Method), are in the field of Return_type.
here i would like to remove the values highlighted from the list of Return_type

Thanks In advance 🙂

Vignesh

0 Karma

Legend

@Vigneshprasanna, if the events with Total:, Source),Method), etc are not required ideally, you should check out how to send them to nullQueue so that they get filtered at index time rather than filtering them out during search time.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

SplunkTrust
SplunkTrust

can you try this ?

index=<your_index> NOT Return_type IN ("Total:" "Source)" "Method)")
0 Karma

Legend

@Vigneshprasanna just FYI IN will work in Splunk 6.6 or higher otherwise you will have to use

<yourBaseSearch> Return_type!="Total:" AND Return_type!="Source)"  AND Return_type!="Method)" 

The additional characters colon : and end bracket ), makes me think you need to re-consider your Field Extraction for Return_type. Community would be able to assist with this however, you would need to provide us with sample events for each (after masking/anonymizing any sensitive data).

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!