Exclude results where two or more fields match

[iomega311]

I am trying to understand how to remove results where "field_a" and "field_a" each contain a certain value together in the same log... but not all results containing "field_a" or all results containing "field_b"... or any other fields.

Here are some example of logs:

field_a=5 field_b=3

field_a=5 field_b=2

field_a=2 field_b=3

I want to exclude only logs where field_a is equal to "5" AND field_b is equal to "3" ... but keep all other results. So, in the log examples above, I would only want to exclude the first log because that is the only example where BOTH fields contain a specific value... I would want my query to return the last two logs.

[richgalloway]

Perhaps this will help.

index=foo NOT (field_a=5 AND field_b=3)

[sbuntin_splunk · Accepted solution]

NOT ( field_a=5 AND field_b=3 )

add this within your base search or in subsequent search command