Splunk Search

How to exclude all days of one month from a time range?

chinmay25
Path Finder

Here is the part of the search that I am working on, and trying to exclude certain numbers of days. However, where Date != 20190401 removes only April 1st from the result. I need to exclude all the days of April.

index:

| where Date != "20190401"
| stats sum(claim_nums) as "Total Claims" by Date
| appendpipe [ stats avg("Total Claims") as ClaimAvg 
| eval ClaimAvg = round(ClaimAvg,2) | eval "Total Claims" = "TOTAL AVG CLAIMS ".ClaimAvg 
| fields - ClaimAvg]
| sort - DATE

I tried adding multiple dates in the where command, but it doesn't work.

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

I'll bet you tried

| where Date != "20190401" OR  Date != "20190402" 

Every record will always be either not the first value or not the second value. You need to use AND to make that kind of code work.

However, you can also do something like this to test them all at the same time, assuming Date is a text field.

| where ( substr(Date,1,6)!="201904" ) 

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

I'll bet you tried

| where Date != "20190401" OR  Date != "20190402" 

Every record will always be either not the first value or not the second value. You need to use AND to make that kind of code work.

However, you can also do something like this to test them all at the same time, assuming Date is a text field.

| where ( substr(Date,1,6)!="201904" ) 
0 Karma

chinmay25
Path Finder

Thanks. Yes I tried the first option but it didn't work. The second option works perfect. Thanks.

0 Karma
Get Updates on the Splunk Community!

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...