Splunk Search

How to remove specified values of a field from a table?

ganinurceski
Engager

Hello there!
I need some help. I have a table, and in that table, there are are a "SHORT_ID", "DATA1 -> ERROR" & "DATA2 -> NO_ERROR" Row. Now I want to remove all results, where the DATA1 Field has a value of 0, zero.

The String look like this...
index= tag= DATA="000000108000000400000058" OR "000000198000000400000000000*" | rex field=DATA "(?P"000000108000000400000058")" | rex field=DATA "(?P"000000198000000400000000")" | chart count by SHORT_ID, ERROR | rename 000000108000000400000058 as ERROR | sort - ERROR | rename NULL as NO_ERROR*

I want to remove every Value of NO_ERROR which has zero in it.
I hope the question is clear 🙂
Thx for response

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If I understand the question correctly, you need to add | where ERROR!=0 to the end of your query.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If I understand the question correctly, you need to add | where ERROR!=0 to the end of your query.

---
If this reply helps you, Karma would be appreciated.
0 Karma

ganinurceski
Engager

Thx for response!
I've added | search NOT ERROR="0" and it worked!

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ganinurceski

Can you please share some sample data & expected output?

0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...