Splunk Search

How do I exclude multiple specific fields from search results?

bcdatacomm
Explorer

I have a saved search that I alert on and there is certain events I don't want the alert to trigger for when it's coming from inside my network.

Basically I have a this saved search:
index=pan_logs (log_subtype=vulnerability OR log_subtype=wildfire) | fields action, severity, CATEGORY, SUBCATEGORY, direction, dst_hostname, dst_ip, dst_user, dst_zone, log_subtype, misc, rule_name, sourcetype, src_ip, src_zone, threat_name, url, protocol, server_location

It sends me all the alerts we want to see, but there is a couple alerts I don't care about. Especially ones that come from "src_zone=inside + dst_zone=outside + threat_name=IIS DDOS"

So, how do I get my search to display everything except the events that are from inside to outside and the threat name is IIS DDOS?

Tags (2)
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Have you tried this?

index=pan_logs (log_subtype=vulnerability OR log_subtype=wildfire) NOT (src_zone=inside AND dst_zone=outside AND threat_name=IIS DDOS) | fields action, severity, CATEGORY, SUBCATEGORY, direction, dst_hostname, dst_ip, dst_user, dst_zone, log_subtype, misc, rule_name, sourcetype, src_ip, src_zone, threat_name, url, protocol, server_location
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Have you tried this?

index=pan_logs (log_subtype=vulnerability OR log_subtype=wildfire) NOT (src_zone=inside AND dst_zone=outside AND threat_name=IIS DDOS) | fields action, severity, CATEGORY, SUBCATEGORY, direction, dst_hostname, dst_ip, dst_user, dst_zone, log_subtype, misc, rule_name, sourcetype, src_ip, src_zone, threat_name, url, protocol, server_location
---
If this reply helps you, Karma would be appreciated.

bcdatacomm
Explorer

That worked! Thanks!

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...