Splunk Search

How to exclude results that start with specific text in a specific field

elloyd4
Explorer

I am trying to find a list of issues in a ticketing system that include a specific keyword that also excludes a list of computer names that start with specific letters that also reside in specific locations but cant figure it out. This is what I have so far.

sourcetype=SOURCE IssueImLookingFor* AND assignment_group_name="Group1" OR "Group2" OR "Group3" NOT Location=("Location1" OR "Location2" OR "Location3")
| search exclude (WorkstationName!=ABC-* OR BCD-* OR CDE-* OR 123-*) 
0 Karma
1 Solution

elloyd4
Explorer

Hello Skalli,

        Thanks for your help. The "Location!=" vs. NOT Location= did not work in my favor, but your advise lead me down a path to type out each value one at a time and that worked for me. It may be a more difficult way to do it, but NotePad++ was able to make quick work of the formatting. Thanks again for your help!

Answer:
sourcetype=SOURCE IssueImLookingFor* AND assignment_group_name="Group1" OR assignment_group_name="Group2" OR assignment_group_name="Group3" NOT Location="Location1" NOT Location="Location2" NOT Location="Location3" NOT WorkstationName=ABC-* NOT WorkstationName=BCD-* NOT WorkstationName=CDE-* NOT WorkstationName=123-*

View solution in original post

0 Karma

elloyd4
Explorer

Hello Skalli,

        Thanks for your help. The "Location!=" vs. NOT Location= did not work in my favor, but your advise lead me down a path to type out each value one at a time and that worked for me. It may be a more difficult way to do it, but NotePad++ was able to make quick work of the formatting. Thanks again for your help!

Answer:
sourcetype=SOURCE IssueImLookingFor* AND assignment_group_name="Group1" OR assignment_group_name="Group2" OR assignment_group_name="Group3" NOT Location="Location1" NOT Location="Location2" NOT Location="Location3" NOT WorkstationName=ABC-* NOT WorkstationName=BCD-* NOT WorkstationName=CDE-* NOT WorkstationName=123-*

0 Karma

skalliger
SplunkTrust
SplunkTrust

Instead of NOT Location= you want to use Location!=. 🙂
And you should chain it like Location!=1 OR Location!=2 ...

Skalli

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...