Splunk Search

Ignoring multiple values from field

JoshuaJohn
Contributor

Brain must not be working today. This should be a simple one. I am trying to ignore multiple values from a field... This works but I would rather not do it this way.

| search SNumber != 9901
| search SNumber != 9900
| search SNumber != 9712
| search SNumber != 9709
| search SNumber!= 8004
| search SNumber != 8001
| search SNumber != 6666

I tried
|search SNumber !=9901,9900,9712,9709,8004,8001,6666
|search SNumber !=(9901,9900,9712,9709,8004,8001,6666)
|search SNumber NOT (9901,9900,9712,9709,8004,8001,6666)
|where SNumber !=9901 OR 9900 OR 9712 OR 9709 OR 8004 OR 8001 OR 6666
to no avail

0 Karma
1 Solution

horsefez
Motivator

Hi,

try some variants like this.

your_inital_search AND NOT (SNumber = 9901 OR SNumber = 9900 OR SNumber = 9712 ... )

or try it with where-command

| where NOT (like(SNumber, "9901") OR like(Snumber, "9900") OR ....)

or

| where NOT (SNumber="9901" OR SNumber="9900" OR ...)

Your variants will not work.

View solution in original post

0 Karma

horsefez
Motivator

Hi,

try some variants like this.

your_inital_search AND NOT (SNumber = 9901 OR SNumber = 9900 OR SNumber = 9712 ... )

or try it with where-command

| where NOT (like(SNumber, "9901") OR like(Snumber, "9900") OR ....)

or

| where NOT (SNumber="9901" OR SNumber="9900" OR ...)

Your variants will not work.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...