Splunk Search

Exclude value based on subsearch

ngerosa
Path Finder

Hello,
I want to exclude some values if that have the field SPAN_LOSS_MAX=50 between midnight to 7 a.m.

This is my approach:

index="flap" DELTA_SPAN>=3 | search NOT
[search index="flap" SPAN_LOSS_MAX=50 | dedup CONCATENATE_Z sortby +_time
|eval Hour=strftime(_time,"%H")
|where Hour>=00 AND Hour<=7
|stats count by Hour]
|dedup CONCATENATE_Z sortby +_time
| eval Hour=strftime(_time,"%H")
| chart count as FLAP by Hour

But this search returns also values that are in the subsearch.

Any Ideas?

Thanks!

Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

Why not just do this

index="flap" DELTA_SPAN>=3 |eval Hour=tonumber(strftime(_time,"%H") )
| where NOT (SPAN_LOSS_MAX=50 AND Hour>=0 AND Hour<7)
|dedup CONCATENATE_Z sortby +_time
| eval Hour=strftime(_time,"%H") 
| chart count as FLAP by Hour

View solution in original post

0 Karma

somesoni2
Revered Legend

Why not just do this

index="flap" DELTA_SPAN>=3 |eval Hour=tonumber(strftime(_time,"%H") )
| where NOT (SPAN_LOSS_MAX=50 AND Hour>=0 AND Hour<7)
|dedup CONCATENATE_Z sortby +_time
| eval Hour=strftime(_time,"%H") 
| chart count as FLAP by Hour
0 Karma

ngerosa
Path Finder

Thanks it works! Just a question:
if I want to exclude also 11 p.m.?
I tried | where NOT (SPAN_LOSS_MAX=50 AND Hour>=0 AND Hour<7 AND Hour !=23 ) but it didn't work.
Thanks

0 Karma

somesoni2
Revered Legend

Try this

...| where NOT (SPAN_LOSS_MAX=50 AND Hour>=23 AND Hour<7)
0 Karma

ngerosa
Path Finder

I've already tried but it didn't work.

0 Karma

rafaelsalazar
Path Finder

NOT (SPAN_LOSS_MAX=50 AND ((Hour>=0 AND Hour<7) OR Hour=23))

0 Karma

ngerosa
Path Finder

Thank you! It works!

0 Karma

rafaelsalazar
Path Finder

Hello ngerosa,

There is already a default hour extraction called date_hour.. if you don't have it, I will recommend building the extraction yourself to be able to filter since search command.

index="flap" DELTA_SPAN>=3 NOT NOT (SPAN_LOSS_MAX=50 AND date_hour>=0 AND date_hour<=7)
| dedup CONCATENATE_Z sortby + _time
| chart count AS FLAP by date_hour

Hope it helps,
Regards.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...