Splunk Search

How to subtract specific events, key pairs?

New Member

Not sure where I should be going but, I am all for raw data going into fields, enhanced etc...
I am looking at our raw data and there is a field called ID=XXXXXX which is the field I am interested in, there is also another occurrence of ID= XXXXX YYYYY in the event which I am not interested in.
Both are showing up in my searches, NAME=MX001 and the second one ID=MX001 YYYYY.
I have tried Eval substr(ID,1,6) to no avail, any help would be appreciated,
P.S. could this have been taken care of during original extraction??

Thanks Ahead

0 Karma

New Member

Let me try to show examples:


1) id=jim,addr=12 main st,phone=825-585-9865

2) id=tom,addr=45 maple,phone=528-777-9685,id=tom second

I am using a simple table:
table id addr phone

jim 12 main st 825-585-9865
tom 45 maple 528-777-9685
tom second
(the line above is the problem)

0 Karma

New Member

I guess what I am trying to do is a report using the first occurrence of a field within an event.

Some events have multiple fields some don't.

I looked at stats first(xx), but it returned first occurrence of first event only.

0 Karma


It should be a matter of adding | search ID!="XXXXX *" to your query. If you share the existing query we can be more specific.

If this reply helps you, Karma would be appreciated.
0 Karma

New Member

Correction: both fields are ID, both are automatically extracted and exist in one event.

Sorry for type

0 Karma


Could you clarify a couple of things?
-Both fields are automatically extracted and they both exist in your index?
-One is called NAME and the other one ID?
-You only have use for NAME but not for ID??

0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...