Splunk Search

How to exclude the rows by comparing the results ?

georgear7
Communicator

I have a below table which shows status of package in each host. Normally 2 kinds of packages are there, one with 'bw' word in it and other without 'bw'. In this case, i only care about 'bw' package'. If my 'bw' package status is 'Successful' anywhere, i just want to ignore the other bw rows which has different status(eg. No_File). Is there any way to do this?

Highlighted the unwanted rows in yellow color.

georgear7_0-1604844145588.png

 

Expected Output:

georgear7_1-1604844206625.png

 

Labels (1)
0 Karma

493669
Super Champion

@georgear7  Try below search which will search Package containing "bw" and status as "successful".

|search Package="*bw*" AND status="Successful"


Try below search with dummy data-

|makeresults|eval Package="a.bw.int-7", status="Successful"
|append[|makeresults|eval Package="a.bw.int-7" , status="No_File"]
|append[|makeresults|eval Package="app.int-4" , status="Successful"]
|search Package="*bw*" AND status="Successful"


If it helps upvote will be appreciated!

 

0 Karma

georgear7
Communicator

@493669 Thanks for your reply. I missed to mention some points. I need both 'bw' and without 'bw' package in the final output but i want this comparison to be done only for 'bw' package. For rest, we can keep as it is. Here my requirement is whenever 'bw' package status is "Successful", i want to ignore rest of the rows for that particular package. Also, please note that, my 'bw' package may not have 'Successful' status as well. So in that case i want to keep all the rows.

 

In simple, compare the rows by package and if it's 'Succesful' anywhere, ignore the rest of the rows. If it's not success, keep all the rows.

0 Karma

georgear7
Communicator

Can anyone help me on this ?

0 Karma
Get Updates on the Splunk Community!

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...