Splunk Search

How to remove specified values of a field from a table?

ganinurceski
Engager

Hello there!
I need some help. I have a table, and in that table, there are are a "SHORT_ID", "DATA1 -> ERROR" & "DATA2 -> NO_ERROR" Row. Now I want to remove all results, where the DATA1 Field has a value of 0, zero.

The String look like this...
index= tag= DATA="000000108000000400000058" OR "000000198000000400000000000*" | rex field=DATA "(?P"000000108000000400000058")" | rex field=DATA "(?P"000000198000000400000000")" | chart count by SHORT_ID, ERROR | rename 000000108000000400000058 as ERROR | sort - ERROR | rename NULL as NO_ERROR*

I want to remove every Value of NO_ERROR which has zero in it.
I hope the question is clear 🙂
Thx for response

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If I understand the question correctly, you need to add | where ERROR!=0 to the end of your query.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If I understand the question correctly, you need to add | where ERROR!=0 to the end of your query.

---
If this reply helps you, Karma would be appreciated.
0 Karma

ganinurceski
Engager

Thx for response!
I've added | search NOT ERROR="0" and it worked!

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ganinurceski

Can you please share some sample data & expected output?

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...