How to exclude data from a field?

[MR1992]

Is there a way to exclude specified data from a single field. The example I have is on Destination IP addresses from a firewall. 

Splunk is currently showing multiple IP addresses in the field that is the direct path from source to destination and some are related to our specific appliances that we do not need to see. e.g. I have 3 IP's as below

1.1.1.1

1.1.1.2

1.1.1.3

I know what 1.1.1.1 and 1.1.1.2 are so I need to exclude them from view on the field but I want to keep 1.1.1.3. I need my know IP's excluded as there are many others that I am not aware of. I have around 50 IP's I want excluded from the field.  

[MR1992]

Yeah it working great, thank you

[ITWhisperer · Accepted solution]

From your description, I assume ip is a multivalue field (?)

| eval ip=mvfilter(ip!="1.1.1.1" AND ip!="1.1.1.2")

[MR1992]

Yes that is correct we have it coming into splunk as list(dest) would this exclude or only show the stated IPs? I would want it to exclude 1.1.1.1 & 1.1.1.2 from the field just to leave 1.1.1.3 on the output

[ITWhisperer]

It keeps what passes the test i.e. everything that is not equal to 1.1.1.1 and not equal to 1.1.1.2