Splunk Search

How do you exclude two matching field values in a search?

johann2017
Explorer

Hello,

I want to make a very specific exclusion from my search. In my case, there are two different field names I am interested in excluding, but I only want to exclude the search result if they BOTH match a specific value. To be more clear:

If "threat_name=WindowsThreat" and "src_ip=192.168.1.0/24" then do not return the search result.
If "threat_name=WindowsThreat" and "src_ip=something other than 192.168.1.0/24" then yes return the search result.
0 Karma
1 Solution

eykrevooh
Explorer

| search NOT (threat_name="WindowsThreat" AND src_ip="192.168.1.0/24")
OR
| where threat_name!="WindowsThreat" AND src_ip="192.168.1.0/24"

Either of these will work to give you all results where threat_name is not "WindowsThreat" and src_ip is not explicitly "192.168.1.0/24". If you are wanting to exclude all src_ips that fall in the CIDR range 192.168.1.0/24. You will need to change the where to...

| where threat_name!="WindowsThreat" AND NOT cidrmatch("192.168.1.0/24", src_ip)

View solution in original post

eykrevooh
Explorer

| search NOT (threat_name="WindowsThreat" AND src_ip="192.168.1.0/24")
OR
| where threat_name!="WindowsThreat" AND src_ip="192.168.1.0/24"

Either of these will work to give you all results where threat_name is not "WindowsThreat" and src_ip is not explicitly "192.168.1.0/24". If you are wanting to exclude all src_ips that fall in the CIDR range 192.168.1.0/24. You will need to change the where to...

| where threat_name!="WindowsThreat" AND NOT cidrmatch("192.168.1.0/24", src_ip)

johann2017
Explorer

Thank you! This worked

0 Karma
Get Updates on the Splunk Community!

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...

Stay Connected: Your Guide to October Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...