Back ground exclusion

[cpeteman]

So I have search and I would like to exclude all of those results from some future searches. Aside from specifying some by NOT, which given the length of the first search would be questionable at best. Is there a way to make this exclusion in the backgrounmd not in search?

Here is the search:

search terms  | eval TimeInHour=_time%3600 
| rex mode=sed "s/ \d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{1,2}:\d{1,2}//g" 
| stats first(_raw) by punct,TimeInHour,_raw,_time 
|  stats count by _raw,TimeInHour,punct 
|  addinfo| eval hours = round((info_max_time - info_min_time)/3600,0) 
| where count > hours-1

[sdaniels · Accepted solution]

Updated:

In this case, you'll want to use a macros and that will allow you to reference the macro and simplify the look of the search and if you ever need to use it in an adhoc fashion you'll just need to remember the macro.

http://docs.splunk.com/Documentation/Splunk/5.0.4/Search/Usesearchmacros

[cpeteman]

I made a new question as a follow up, but I've not forgotten this one. if it gets answered and it turns out that macro's are the way to go I'll mark this as the right answers 😉

[cpeteman]

Having trouble, based on the posted search do you know how I would make the filter macro?

[cpeteman]

Ah ok,,,,,

[sdaniels]

You can't use a macro in that way with NOT. However you write the macro the intent should be that it filters out what you don't want to see.

[cpeteman]

So I got the marco running as hourly when I search:

hourly I get the results I would expect

However excluding

search terms NOThourly``

gives no results which is not what I expected or want.

[sdaniels]

Updated above. You can use the SED command at index time and mask or delete data as well. However, that would affect all future searches of that data.

[cpeteman]

I posted as you can see it needs quite a bit of piping

[sdaniels]

Lets see the search and what you are trying to simplify. Eventtype will be for anything narrowing down search without and pipes like sourcetype='x' AND error NOT failure NOT critical NOT down. A macros can make use of pipes however. Depends on what you are trying to achieve.

http://docs.splunk.com/Documentation/Splunk/5.0.4/Search/Usesearchmacros

[cpeteman]

So I tried creating an event type but the search I have is too complicated and gives me:

" Message: Eventtype search string cannot be a search pipeline or contain a subsearch"

Want me to post the full search?