Splunk Search

Elegant way of searching for all events where a field is not in a literal list of values

bobmorning
Engager

What is the most elegant way of searching for events where a field is not in a list of values?   For example:

index=foo | iplocation foo_src_ip |  search Country IN ("France", "United States")

works great.   

But what if I want all events where the IP was not from those countries (the  inverse answer), like "Canada", "Mexico".

Thanks for any assistance.

Bob

Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try

index=foo | iplocation foo_src_ip |  search NOT Country IN ("France", "United States") 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try

index=foo | iplocation foo_src_ip |  search NOT Country IN ("France", "United States") 
Get Updates on the Splunk Community!

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...