Splunk Search

How can I filter all events to exclude this string?

POR160893
Builder

Hi,

I have an index of log events and I have been asked to exclude all events with a certain string in it. The String I need to omit is drminprtmgmt.isus.emc.com. This string (which represents a device) is not mapped to any field currently. How can I filter all events to exclude this string?

This is currently what I have (which does NOT work):

POR160893_0-1649672970092.png

 




Many thanks,
Patrick

Labels (1)
Tags (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @POR160893,

as @PickleRick said, you have to use the search command or (better) put the string to exclude in the main search, something like this:

index=ironport sourcetype=cisco:wsa:squid NOT drminprtmgmt.isus.emc.com

Ciao.

Giuseppe

POR160893
Builder

This worked perfectly, thanks! 😁

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @POR160893 ,

good for you, if this answer solves your need, please accept it or the other people of Community, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

PickleRick
SplunkTrust
SplunkTrust

Don't use the "where" command - it's meant for boolean-evaluating conditions. Use the "search" command.

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...