Splunk Search

Ignoring multiple values from field

JoshuaJohn
Contributor

Brain must not be working today. This should be a simple one. I am trying to ignore multiple values from a field... This works but I would rather not do it this way.

| search SNumber != 9901
| search SNumber != 9900
| search SNumber != 9712
| search SNumber != 9709
| search SNumber!= 8004
| search SNumber != 8001
| search SNumber != 6666

I tried
|search SNumber !=9901,9900,9712,9709,8004,8001,6666
|search SNumber !=(9901,9900,9712,9709,8004,8001,6666)
|search SNumber NOT (9901,9900,9712,9709,8004,8001,6666)
|where SNumber !=9901 OR 9900 OR 9712 OR 9709 OR 8004 OR 8001 OR 6666
to no avail

0 Karma
1 Solution

horsefez
Motivator

Hi,

try some variants like this.

your_inital_search AND NOT (SNumber = 9901 OR SNumber = 9900 OR SNumber = 9712 ... )

or try it with where-command

| where NOT (like(SNumber, "9901") OR like(Snumber, "9900") OR ....)

or

| where NOT (SNumber="9901" OR SNumber="9900" OR ...)

Your variants will not work.

View solution in original post

0 Karma

horsefez
Motivator

Hi,

try some variants like this.

your_inital_search AND NOT (SNumber = 9901 OR SNumber = 9900 OR SNumber = 9712 ... )

or try it with where-command

| where NOT (like(SNumber, "9901") OR like(Snumber, "9900") OR ....)

or

| where NOT (SNumber="9901" OR SNumber="9900" OR ...)

Your variants will not work.

0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...