Splunk Search

How do you ignore an output in a Table Listing?

albyva
Communicator

Lets assume you have the following search:

index=usgs_* source=usgs place=*California | table time, place, mag, depth

And your output is something like:

1/1/2014 San Francisco 4.5 1000m
1/2/2014 Oakland 3.8 500m
1/3/2014 San Jose 3.7 750m

If I wanted to ignore every "Oakland" entry in the table output, how would I do that?

Thanks,

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Give this a shot:

index=usgs_* source=usgs place=*California NOT place=Oakland | table time place mag depth

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Give this a shot:

index=usgs_* source=usgs place=*California NOT place=Oakland | table time place mag depth

albyva
Communicator

Thanks. Brain fart.. 🙂

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...