Splunk Search

How do I exclude multiple specific fields from search results?

bcdatacomm
Explorer

I have a saved search that I alert on and there is certain events I don't want the alert to trigger for when it's coming from inside my network.

Basically I have a this saved search:
index=pan_logs (log_subtype=vulnerability OR log_subtype=wildfire) | fields action, severity, CATEGORY, SUBCATEGORY, direction, dst_hostname, dst_ip, dst_user, dst_zone, log_subtype, misc, rule_name, sourcetype, src_ip, src_zone, threat_name, url, protocol, server_location

It sends me all the alerts we want to see, but there is a couple alerts I don't care about. Especially ones that come from "src_zone=inside + dst_zone=outside + threat_name=IIS DDOS"

So, how do I get my search to display everything except the events that are from inside to outside and the threat name is IIS DDOS?

Tags (2)
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Have you tried this?

index=pan_logs (log_subtype=vulnerability OR log_subtype=wildfire) NOT (src_zone=inside AND dst_zone=outside AND threat_name=IIS DDOS) | fields action, severity, CATEGORY, SUBCATEGORY, direction, dst_hostname, dst_ip, dst_user, dst_zone, log_subtype, misc, rule_name, sourcetype, src_ip, src_zone, threat_name, url, protocol, server_location
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Have you tried this?

index=pan_logs (log_subtype=vulnerability OR log_subtype=wildfire) NOT (src_zone=inside AND dst_zone=outside AND threat_name=IIS DDOS) | fields action, severity, CATEGORY, SUBCATEGORY, direction, dst_hostname, dst_ip, dst_user, dst_zone, log_subtype, misc, rule_name, sourcetype, src_ip, src_zone, threat_name, url, protocol, server_location
---
If this reply helps you, Karma would be appreciated.

bcdatacomm
Explorer

That worked! Thanks!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...