Splunk Search

Help with search


Hi, I am using Splunk to grab disk drive metrics but often times I am pulling metrics for drives I don't care about. I want to exclude these from some searches, I am able to do this with a series of NOT/OR commands, as shown below,  but I feel like there is an easier way with less syntax. 

How can I exclude instances G thru L ,  in one command, without having to specify each instance as I do below?

host=vor* NOT (host="vor-pxy-prd1*" instance=G: OR instance=H: OR instance=I: OR instance=J: OR instance=K: OR instance=L:)


Thanks for any ideas -

Labels (1)
0 Karma


The first one worked great.  I'm not able to get any results from the 2nd one even the drives I want do not show up, not sure why but I am not overly familiar with the regex side in Splunk.  Thanks

0 Karma


These are both great ideas and look cleaner than what I have been using - thank you!

0 Karma


There are a couple of alternatives, but neither is much better than what you have now.

Use IN

host=vor* NOT (host="vor-pxy-prd1*" instance IN ("G:", "H:", "I:", "J:", "K:", "L:")

Or use regex to filter using a regular expression

host=vor* NOT (host="vor-pxy-prd1*")
| regex instance="^[GHIJKL]:"
If this reply helps you, an upvote would be appreciated.
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!