Splunk Search

Ignoring multiple values from field

JoshuaJohn
Contributor

Brain must not be working today. This should be a simple one. I am trying to ignore multiple values from a field... This works but I would rather not do it this way.

| search SNumber != 9901
| search SNumber != 9900
| search SNumber != 9712
| search SNumber != 9709
| search SNumber!= 8004
| search SNumber != 8001
| search SNumber != 6666

I tried
|search SNumber !=9901,9900,9712,9709,8004,8001,6666
|search SNumber !=(9901,9900,9712,9709,8004,8001,6666)
|search SNumber NOT (9901,9900,9712,9709,8004,8001,6666)
|where SNumber !=9901 OR 9900 OR 9712 OR 9709 OR 8004 OR 8001 OR 6666
to no avail

0 Karma
1 Solution

horsefez
Motivator

Hi,

try some variants like this.

your_inital_search AND NOT (SNumber = 9901 OR SNumber = 9900 OR SNumber = 9712 ... )

or try it with where-command

| where NOT (like(SNumber, "9901") OR like(Snumber, "9900") OR ....)

or

| where NOT (SNumber="9901" OR SNumber="9900" OR ...)

Your variants will not work.

View solution in original post

0 Karma

horsefez
Motivator

Hi,

try some variants like this.

your_inital_search AND NOT (SNumber = 9901 OR SNumber = 9900 OR SNumber = 9712 ... )

or try it with where-command

| where NOT (like(SNumber, "9901") OR like(Snumber, "9900") OR ....)

or

| where NOT (SNumber="9901" OR SNumber="9900" OR ...)

Your variants will not work.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...