Splunk Search

How to search not equal with multivalued?

Rithekakan
Path Finder

host="SPL-SH-DC" sourcetype="csv" source="****" 
Severity!="Info"
Severity!="low"
Plugin_Name!="SSL Certificate with Wrong Hostname"
Plugin_Name!="Unix Operating System Unsupported Version Detection"
Plugin_Name!="SSL Self-Signed Certificate"
Plugin_Name!="SSL Certificate Cannot Be Trusted"
Port!="8089"
Port!="6502"
| table IP_Address,device_name,Plugin_Name, Severity,model, Protocol, Port, Exploit, Synopsis, Description, Solution, See_Also, CVSS_V2_Base_Score, CVE,Plugin

Thanks for your help!

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
NOT Plugin_Name IN (A,B,C,D)

View solution in original post

Rithekakan
Path Finder

The search result is correct. How ever I am looking for  a short way  writing  not equal  for the same fields and different values. 
Plugin_Name!="A"
Plugin_Name!="B"
Plugin_Name!="C"
Plugin_Name!="D"

I've tried this but it not working.

Plugin_Name !IN (A,B,C,D)

Regards,
Rithekakan
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
NOT Plugin_Name IN (A,B,C,D)

Rithekakan
Path Finder

Hi ITWhisperer,

I got it now. Thanks for your help.

Regards,

Rithekakan 

 
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What you have will search for events which are not equal to the values you are trying to exclude. What else are you asking for?

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...