Splunk Search

How to exclude multiple values from multiple fields?

rnikam1412
Loves-to-Learn Everything

I am trying to filter multiple values from two fields but not getting the expected result.

index=test_01 EventCode=4670 NOT (Field 1 = value1 OR Field 1 = value2) NOT (Process_Name = value 3 OR Process_Name = value 4)

 

I am geting splunk results which includes Process_Name=value 3 and Process_Name=value 4

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Are you sure your value 3 and value 4 do not contain, for example, white space?  I cannot help but notice that you did not quote "value 3" and "value 4".  If the search is illustrative, it should be something like

index=test_01 EventCode=4670 NOT ("Field 1" = value1 OR "Field 1" = value2) NOT (Process_Name = "value 3" OR Process_Name = "value 4")
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your search looks OK - can you share some of the events (anonymised of course) which are being found which shouldn't be?

0 Karma
Get Updates on the Splunk Community!

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

What's New in Splunk Observability - July 2025

What’s New?  We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what ...