Splunk Search

How to exclude results that start with specific text in a specific field

elloyd4
Explorer

I am trying to find a list of issues in a ticketing system that include a specific keyword that also excludes a list of computer names that start with specific letters that also reside in specific locations but cant figure it out. This is what I have so far.

sourcetype=SOURCE IssueImLookingFor* AND assignment_group_name="Group1" OR "Group2" OR "Group3" NOT Location=("Location1" OR "Location2" OR "Location3")
| search exclude (WorkstationName!=ABC-* OR BCD-* OR CDE-* OR 123-*) 
0 Karma
1 Solution

elloyd4
Explorer

Hello Skalli,

        Thanks for your help. The "Location!=" vs. NOT Location= did not work in my favor, but your advise lead me down a path to type out each value one at a time and that worked for me. It may be a more difficult way to do it, but NotePad++ was able to make quick work of the formatting. Thanks again for your help!

Answer:
sourcetype=SOURCE IssueImLookingFor* AND assignment_group_name="Group1" OR assignment_group_name="Group2" OR assignment_group_name="Group3" NOT Location="Location1" NOT Location="Location2" NOT Location="Location3" NOT WorkstationName=ABC-* NOT WorkstationName=BCD-* NOT WorkstationName=CDE-* NOT WorkstationName=123-*

View solution in original post

0 Karma

elloyd4
Explorer

Hello Skalli,

        Thanks for your help. The "Location!=" vs. NOT Location= did not work in my favor, but your advise lead me down a path to type out each value one at a time and that worked for me. It may be a more difficult way to do it, but NotePad++ was able to make quick work of the formatting. Thanks again for your help!

Answer:
sourcetype=SOURCE IssueImLookingFor* AND assignment_group_name="Group1" OR assignment_group_name="Group2" OR assignment_group_name="Group3" NOT Location="Location1" NOT Location="Location2" NOT Location="Location3" NOT WorkstationName=ABC-* NOT WorkstationName=BCD-* NOT WorkstationName=CDE-* NOT WorkstationName=123-*

0 Karma

skalliger
Motivator

Instead of NOT Location= you want to use Location!=. 🙂
And you should chain it like Location!=1 OR Location!=2 ...

Skalli

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...