Solved: Re: NOT like multiple values - Splunk Community

Splunk Search

Looking to exclude certain values for field instance. How can I achieve this?
Propose code (not working)

index=abc sourcetype=xyz IncomingMessage
| rex field=source "/apps/prod/(?<instance>.*)/logs"   
| where NOT LIKE instance IN ("foo", "bar")

1 Solution

Solution

thanks, this works
| where NOT LIKE(instance, "%foo%") AND NOT LIKE(instance, "%bar%")

View solution in original post

Solution

thanks, this works
| where NOT LIKE(instance, "%foo%") AND NOT LIKE(instance, "%bar%")

I see, accept your answers.

check reference
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Where
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval

Get Updates on the Splunk Community!

Splunk and TLS: It doesn't have to be too hard

Overview Creating a TLS cert for Splunk usage is pretty much standard openssl. To make life better, use an ...

Faster Insights with AI, Streamlined Cloud-Native Operations, and More New Lantern ...

Splunk Lantern is a Splunk customer success center that provides practical guidance from Splunk experts on key ...

Splunk Enterprise Security: Your Command Center for PCI DSS Compliance

Every security professional knows the drill. The PCI DSS audit is approaching, and suddenly everyone's asking ...