Splunk Search

How can i remove the particular user in table?

Sangeetha96
Engager

I have the below query:

| inputlookup test.csv
| eval epochtime=strptime(_time, "%a %b %d %H:%M:%S %Y")
| eval desired_time=strftime(epochtime, "%d/%m/%Y")
| rename desired_time as Date
| eval desired_time=strftime(epochtime, "%b%y'")
| rename desired_time as Month

 

am getting this output in user field.

user

Abcd101

sv23010

ns03621

here i want to remove the user sv48840,ns19075 row in this table.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| where user!="sv48840" AND user!="ns19075"

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| where user!="sv48840" AND user!="ns19075"
0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...