Splunk Search

How to search not equal with multivalued?

Rithekakan
Path Finder

host="SPL-SH-DC" sourcetype="csv" source="****" 
Severity!="Info"
Severity!="low"
Plugin_Name!="SSL Certificate with Wrong Hostname"
Plugin_Name!="Unix Operating System Unsupported Version Detection"
Plugin_Name!="SSL Self-Signed Certificate"
Plugin_Name!="SSL Certificate Cannot Be Trusted"
Port!="8089"
Port!="6502"
| table IP_Address,device_name,Plugin_Name, Severity,model, Protocol, Port, Exploit, Synopsis, Description, Solution, See_Also, CVSS_V2_Base_Score, CVE,Plugin

Thanks for your help!

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
NOT Plugin_Name IN (A,B,C,D)

View solution in original post

Rithekakan
Path Finder

The search result is correct. How ever I am looking for  a short way  writing  not equal  for the same fields and different values. 
Plugin_Name!="A"
Plugin_Name!="B"
Plugin_Name!="C"
Plugin_Name!="D"

I've tried this but it not working.

Plugin_Name !IN (A,B,C,D)

Regards,
Rithekakan
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
NOT Plugin_Name IN (A,B,C,D)

Rithekakan
Path Finder

Hi ITWhisperer,

I got it now. Thanks for your help.

Regards,

Rithekakan 

 
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What you have will search for events which are not equal to the values you are trying to exclude. What else are you asking for?

0 Karma
Get Updates on the Splunk Community!

New This Month in Splunk Observability Cloud - Metrics Usage Analytics, Enhanced K8s ...

The latest enhancements across the Splunk Observability portfolio deliver greater flexibility, better data and ...

Alerting Best Practices: How to Create Good Detectors

At their best, detectors and the alerts they trigger notify teams when applications aren’t performing as ...

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...