Splunk Search

How to edit my search to filter out a certain result?

yzimmer
New Member

Hi everybody!

In a Splunk Dashboard, I created a Bar Panel with this:

* | stats count(U*) as U* | transpose | rename column AS Property "row 1" AS Count | SORT -Count

That's works fine! But I don't want to have the Property "U8_DOCUMENTTITLE" in my result....

So I have to change that:

stats count(U*) as U*

How can I ask "U* without U8_DOCUMENTTITLE" ?

Thanks to help me 😉

0 Karma
1 Solution

ryanoconnor
Builder

can you exclude anything that that field in your first search term?

 * NOT U8_DOCUMENTTITLE=* | stats count(U*) as U* | transpose | rename column AS Property "row 1" AS Count | SORT -Count

Or exclude it in the middle:

 * | stats count(U*) as U* | transpose |search column!=U8_DOCUMENTTITLE |rename column AS Property "row 1" AS Count | SORT -Count

View solution in original post

sundareshr
Legend

Try this

 * | stats count(U*) as U* | transpose | rename column AS Property "row 1" AS Count | SORT -Count | search Property !="U8_DOCUMENTTITLE"
0 Karma

yzimmer
New Member

Hi Sundareshr!

Thanks for your answer, that 's work too, but Ryan was so fast 😉

Have a good day!

0 Karma

ryanoconnor
Builder

can you exclude anything that that field in your first search term?

 * NOT U8_DOCUMENTTITLE=* | stats count(U*) as U* | transpose | rename column AS Property "row 1" AS Count | SORT -Count

Or exclude it in the middle:

 * | stats count(U*) as U* | transpose |search column!=U8_DOCUMENTTITLE |rename column AS Property "row 1" AS Count | SORT -Count

yzimmer
New Member

Hi Ryan!
Thanks a lot for your answer!
This code doesn't work:

* NOT U8_DOCUMENTTITLE=*

But this code works perfectly :

search column!=U1708_DOCUMENTTITLE

Thanks for your help!

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...