Splunk Search

How can I exclude only from source X to destination Y and Z?

danutmatei
Explorer

Hello, I'm working on a use case where I have 1 source and 2 destinations. Everything that is found between the source and the 2 destinations need to be excluded. So I've used:

where source = X AND destination != Y OR destination != Z

But this will filter the logs and will display only the logs that comes from source X and the logs that comes from other sources will be excluded as well.

How I can exclude only from source X to destination Y and Z ?

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @danutmatei,

yes, this is the condition. it should run, otherwise, you can use the search command:

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @danutmatei,

if you want to exclude from your results the events from source and one of the destinations, you could run something like this:

index=your_index NOT (source=X (destination=Y OR destination=Z))
| ...

Ciao.

Giuseppe

danutmatei
Explorer

If I have the logs from a data model, can I use this ?

from datamodel=firewall_logs where NOT (source="X" (destination="Y" OR destination="Z"))

thank you

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @danutmatei,

yes, this is the condition. it should run, otherwise, you can use the search command:

Ciao.

Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @danutmatei,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...