Splunk Search

Ignoring multiple values from field

JoshuaJohn
Contributor

Brain must not be working today. This should be a simple one. I am trying to ignore multiple values from a field... This works but I would rather not do it this way.

| search SNumber != 9901
| search SNumber != 9900
| search SNumber != 9712
| search SNumber != 9709
| search SNumber!= 8004
| search SNumber != 8001
| search SNumber != 6666

I tried
|search SNumber !=9901,9900,9712,9709,8004,8001,6666
|search SNumber !=(9901,9900,9712,9709,8004,8001,6666)
|search SNumber NOT (9901,9900,9712,9709,8004,8001,6666)
|where SNumber !=9901 OR 9900 OR 9712 OR 9709 OR 8004 OR 8001 OR 6666
to no avail

0 Karma
1 Solution

horsefez
Motivator

Hi,

try some variants like this.

your_inital_search AND NOT (SNumber = 9901 OR SNumber = 9900 OR SNumber = 9712 ... )

or try it with where-command

| where NOT (like(SNumber, "9901") OR like(Snumber, "9900") OR ....)

or

| where NOT (SNumber="9901" OR SNumber="9900" OR ...)

Your variants will not work.

View solution in original post

0 Karma

horsefez
Motivator

Hi,

try some variants like this.

your_inital_search AND NOT (SNumber = 9901 OR SNumber = 9900 OR SNumber = 9712 ... )

or try it with where-command

| where NOT (like(SNumber, "9901") OR like(Snumber, "9900") OR ....)

or

| where NOT (SNumber="9901" OR SNumber="9900" OR ...)

Your variants will not work.

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...