Splunk Search

How to exclude all days of one month from a time range?

chinmay25
Path Finder

Here is the part of the search that I am working on, and trying to exclude certain numbers of days. However, where Date != 20190401 removes only April 1st from the result. I need to exclude all the days of April.

index:

| where Date != "20190401"
| stats sum(claim_nums) as "Total Claims" by Date
| appendpipe [ stats avg("Total Claims") as ClaimAvg 
| eval ClaimAvg = round(ClaimAvg,2) | eval "Total Claims" = "TOTAL AVG CLAIMS ".ClaimAvg 
| fields - ClaimAvg]
| sort - DATE

I tried adding multiple dates in the where command, but it doesn't work.

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

I'll bet you tried

| where Date != "20190401" OR  Date != "20190402" 

Every record will always be either not the first value or not the second value. You need to use AND to make that kind of code work.

However, you can also do something like this to test them all at the same time, assuming Date is a text field.

| where ( substr(Date,1,6)!="201904" ) 

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

I'll bet you tried

| where Date != "20190401" OR  Date != "20190402" 

Every record will always be either not the first value or not the second value. You need to use AND to make that kind of code work.

However, you can also do something like this to test them all at the same time, assuming Date is a text field.

| where ( substr(Date,1,6)!="201904" ) 
0 Karma

chinmay25
Path Finder

Thanks. Yes I tried the first option but it didn't work. The second option works perfect. Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...