Splunk Search

Adding filter to query using IN

shrogers
Loves-to-Learn Everything

Can I please get some assistance on the below?

I'm trying to add a filter TRAN_CLASS!=6 to the below query. When I add the filter to after the index, Total_Pages2 shows a zero.

index=dev sourcetype IN (ibm:was:performanceLog, ibm:was:cp:performanceLog, ar:mdm) source IN ("/data/sharedDir/wp/*/logs/ARWP*Srv*/performance.log", "/data/sharedDir/cp/*/logs/ARCP*Srv*/sspperformance.log", "/data/infamdm_dev/hub/server/logs/EmpiW**bleep**Stats.log") | fields TRAN_TYPE, respTime | stats count(TRAN_TYPE) as Total_Pages1, count(respTime) as "Total_Pages2" | addtotals fieldname="Total Pages" |fields "Total Pages"

Any assistance provided is appreciated.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please share the exact query using TRAN_CLASS!=6 so we can see how you're using it.

Have checked that events with TRAN_CLASS values other than 6 have a respTime field?

---
If this reply helps you, Karma would be appreciated.
0 Karma

shrogers
Loves-to-Learn Everything

Thank you for the assistance.

Please see the query with TRAN_CLASS!=6. TRAN_CLASS is only available in (ibm:was:performanceLog, ibm:was:cp:performanceLog)

index=dev TRAN_CLASS!=6 sourcetype IN (ibm:was:performanceLog, ibm:was:cp:performanceLog, ar:mdm) source IN ("/data/sharedDir/wp/*/logs/ARWP*Srv*/performance.log", "/data/sharedDir/cp/*/logs/ARCP*Srv*/sspperformance.log", "/data/infamdm_dev/hub/server/logs/EmpiW**bleep**Stats.log") | fields TRAN_TYPE, respTime | stats count(TRAN_TYPE) as Total_Pages1, count(respTime) as "Total_Pages2" | addtotals fieldname="Total Pages" |fields "Total Pages"

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this alternative

index=dev NOT TRAN_CLASS=6 sourcetype IN (ibm:was:performanceLog, ibm:was:cp:performanceLog, ar:mdm) source IN ("/data/sharedDir/wp/*/logs/ARWP*Srv*/performance.log", "/data/sharedDir/cp/*/logs/ARCP*Srv*/sspperformance.log", "/data/infamdm_dev/hub/server/logs/EmpiW**bleep**Stats.log") | fields TRAN_TYPE, respTime | stats count(TRAN_TYPE) as Total_Pages1, count(respTime) as "Total_Pages2" | addtotals fieldname="Total Pages" |fields "Total Pages"
---
If this reply helps you, Karma would be appreciated.
0 Karma

shrogers
Loves-to-Learn Everything

Thank you for your assistance. That query works.

My only concern with using NOT instead of "!=" is that NOT will bring back all rows even if TRAN_CLASS=' '. Plus TRAN_CLASS is not a field in "ar:mdm" and just using "!=" will affect respTime.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...