Splunk Search

Adding filter to query using IN

shrogers
Loves-to-Learn Everything

Can I please get some assistance on the below?

I'm trying to add a filter TRAN_CLASS!=6 to the below query. When I add the filter to after the index, Total_Pages2 shows a zero.

index=dev sourcetype IN (ibm:was:performanceLog, ibm:was:cp:performanceLog, ar:mdm) source IN ("/data/sharedDir/wp/*/logs/ARWP*Srv*/performance.log", "/data/sharedDir/cp/*/logs/ARCP*Srv*/sspperformance.log", "/data/infamdm_dev/hub/server/logs/EmpiW**bleep**Stats.log") | fields TRAN_TYPE, respTime | stats count(TRAN_TYPE) as Total_Pages1, count(respTime) as "Total_Pages2" | addtotals fieldname="Total Pages" |fields "Total Pages"

Any assistance provided is appreciated.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please share the exact query using TRAN_CLASS!=6 so we can see how you're using it.

Have checked that events with TRAN_CLASS values other than 6 have a respTime field?

---
If this reply helps you, Karma would be appreciated.
0 Karma

shrogers
Loves-to-Learn Everything

Thank you for the assistance.

Please see the query with TRAN_CLASS!=6. TRAN_CLASS is only available in (ibm:was:performanceLog, ibm:was:cp:performanceLog)

index=dev TRAN_CLASS!=6 sourcetype IN (ibm:was:performanceLog, ibm:was:cp:performanceLog, ar:mdm) source IN ("/data/sharedDir/wp/*/logs/ARWP*Srv*/performance.log", "/data/sharedDir/cp/*/logs/ARCP*Srv*/sspperformance.log", "/data/infamdm_dev/hub/server/logs/EmpiW**bleep**Stats.log") | fields TRAN_TYPE, respTime | stats count(TRAN_TYPE) as Total_Pages1, count(respTime) as "Total_Pages2" | addtotals fieldname="Total Pages" |fields "Total Pages"

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this alternative

index=dev NOT TRAN_CLASS=6 sourcetype IN (ibm:was:performanceLog, ibm:was:cp:performanceLog, ar:mdm) source IN ("/data/sharedDir/wp/*/logs/ARWP*Srv*/performance.log", "/data/sharedDir/cp/*/logs/ARCP*Srv*/sspperformance.log", "/data/infamdm_dev/hub/server/logs/EmpiW**bleep**Stats.log") | fields TRAN_TYPE, respTime | stats count(TRAN_TYPE) as Total_Pages1, count(respTime) as "Total_Pages2" | addtotals fieldname="Total Pages" |fields "Total Pages"
---
If this reply helps you, Karma would be appreciated.
0 Karma

shrogers
Loves-to-Learn Everything

Thank you for your assistance. That query works.

My only concern with using NOT instead of "!=" is that NOT will bring back all rows even if TRAN_CLASS=' '. Plus TRAN_CLASS is not a field in "ar:mdm" and just using "!=" will affect respTime.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...