How can I filter my search if I don't want to return results containing certain field-value pairs?

[sympatiko]

Hi splunkers,

Good day! How can I write a search if I don't want all HOST and PROCESS fields.

Say for example, I don't want:
host=10.10.10.10, process=apache2, mysql, etc..

Thanks

[sduff_splunk · Accepted solution]

NOT host=10.10.10.10 NOT process=apache2 NOT process=mysql

[woodcock]

Please also be aware that NOT process=apache2 is NOT the same as process!=apache2. The former keeps events where isnull(process) is TRUE, whereas the latter does not (drops events where isnull(process) is TRUE. This may matter to you.

[sympatiko]

You're a God!

[MuS]

Just to add something; NOT search should be avoided, especially in regards of search performance and scalability. See the docs about this http://docs.splunk.com/Documentation/Splunk/6.2.4/Search/Writebettersearches#Tips_for_tuning_your_se...

[sympatiko]

Thanks for the tips. But no worries I just used it in order to extract a specific details from a data that I uploaded