Splunk Search

How do you ignore an output in a Table Listing?

albyva
Communicator

Lets assume you have the following search:

index=usgs_* source=usgs place=*California | table time, place, mag, depth

And your output is something like:

1/1/2014 San Francisco 4.5 1000m
1/2/2014 Oakland 3.8 500m
1/3/2014 San Jose 3.7 750m

If I wanted to ignore every "Oakland" entry in the table output, how would I do that?

Thanks,

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Give this a shot:

index=usgs_* source=usgs place=*California NOT place=Oakland | table time place mag depth

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Give this a shot:

index=usgs_* source=usgs place=*California NOT place=Oakland | table time place mag depth

albyva
Communicator

Thanks. Brain fart.. 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...