Splunk Search

Adding filter to query using IN

shrogers
Loves-to-Learn Everything

Can I please get some assistance on the below?

I'm trying to add a filter TRAN_CLASS!=6 to the below query. When I add the filter to after the index, Total_Pages2 shows a zero.

index=dev sourcetype IN (ibm:was:performanceLog, ibm:was:cp:performanceLog, ar:mdm) source IN ("/data/sharedDir/wp/*/logs/ARWP*Srv*/performance.log", "/data/sharedDir/cp/*/logs/ARCP*Srv*/sspperformance.log", "/data/infamdm_dev/hub/server/logs/EmpiW**bleep**Stats.log") | fields TRAN_TYPE, respTime | stats count(TRAN_TYPE) as Total_Pages1, count(respTime) as "Total_Pages2" | addtotals fieldname="Total Pages" |fields "Total Pages"

Any assistance provided is appreciated.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please share the exact query using TRAN_CLASS!=6 so we can see how you're using it.

Have checked that events with TRAN_CLASS values other than 6 have a respTime field?

---
If this reply helps you, Karma would be appreciated.
0 Karma

shrogers
Loves-to-Learn Everything

Thank you for the assistance.

Please see the query with TRAN_CLASS!=6. TRAN_CLASS is only available in (ibm:was:performanceLog, ibm:was:cp:performanceLog)

index=dev TRAN_CLASS!=6 sourcetype IN (ibm:was:performanceLog, ibm:was:cp:performanceLog, ar:mdm) source IN ("/data/sharedDir/wp/*/logs/ARWP*Srv*/performance.log", "/data/sharedDir/cp/*/logs/ARCP*Srv*/sspperformance.log", "/data/infamdm_dev/hub/server/logs/EmpiW**bleep**Stats.log") | fields TRAN_TYPE, respTime | stats count(TRAN_TYPE) as Total_Pages1, count(respTime) as "Total_Pages2" | addtotals fieldname="Total Pages" |fields "Total Pages"

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this alternative

index=dev NOT TRAN_CLASS=6 sourcetype IN (ibm:was:performanceLog, ibm:was:cp:performanceLog, ar:mdm) source IN ("/data/sharedDir/wp/*/logs/ARWP*Srv*/performance.log", "/data/sharedDir/cp/*/logs/ARCP*Srv*/sspperformance.log", "/data/infamdm_dev/hub/server/logs/EmpiW**bleep**Stats.log") | fields TRAN_TYPE, respTime | stats count(TRAN_TYPE) as Total_Pages1, count(respTime) as "Total_Pages2" | addtotals fieldname="Total Pages" |fields "Total Pages"
---
If this reply helps you, Karma would be appreciated.
0 Karma

shrogers
Loves-to-Learn Everything

Thank you for your assistance. That query works.

My only concern with using NOT instead of "!=" is that NOT will bring back all rows even if TRAN_CLASS=' '. Plus TRAN_CLASS is not a field in "ar:mdm" and just using "!=" will affect respTime.

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...