Splunk Search

How to exclude splunk cloud server logs from my search

kaphie2002
New Member

I have a new splunk instance and I am seeing log entries for the splunk cloud host logs with host names:

dx*
idx-i-*
sh-i-*
c0m1-i-*

Is it possible to remove these entries from default searches in the UI?

Tags (2)
0 Karma

mayurr98
Super Champion

Hey

You can build a macro if this is something which is repetitive and you want to perform for every search.
Refer below doc to build a macro.
http://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/Definesearchmacros

Build a macro with the following query

index=<your_index> NOT host IN (dx*,idx-i-,sh-i-,c0m1-i-*)

let me know if this helps!

0 Karma

splunker12er
Motivator

You can using NOT operator and specify the list of host name (use can use wildcard) you want to exclude

query will be like ,

index=* NOT (host="dx*" OR host="idx-i-" OR host="sh-i-" OR host="c0m1-i-*") 
0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...