Splunk Search

How to remove specified values of a field from a table?

ganinurceski
Engager

Hello there!
I need some help. I have a table, and in that table, there are are a "SHORT_ID", "DATA1 -> ERROR" & "DATA2 -> NO_ERROR" Row. Now I want to remove all results, where the DATA1 Field has a value of 0, zero.

The String look like this...
index= tag= DATA="000000108000000400000058" OR "000000198000000400000000000*" | rex field=DATA "(?P"000000108000000400000058")" | rex field=DATA "(?P"000000198000000400000000")" | chart count by SHORT_ID, ERROR | rename 000000108000000400000058 as ERROR | sort - ERROR | rename NULL as NO_ERROR*

I want to remove every Value of NO_ERROR which has zero in it.
I hope the question is clear 🙂
Thx for response

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If I understand the question correctly, you need to add | where ERROR!=0 to the end of your query.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If I understand the question correctly, you need to add | where ERROR!=0 to the end of your query.

---
If this reply helps you, Karma would be appreciated.
0 Karma

ganinurceski
Engager

Thx for response!
I've added | search NOT ERROR="0" and it worked!

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ganinurceski

Can you please share some sample data & expected output?

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...