Solved: Re: NOT like multiple values - Splunk Community

Splunk Search

Looking to exclude certain values for field instance. How can I achieve this?
Propose code (not working)

index=abc sourcetype=xyz IncomingMessage
| rex field=source "/apps/prod/(?<instance>.*)/logs"   
| where NOT LIKE instance IN ("foo", "bar")

1 Solution

Solution

thanks, this works
| where NOT LIKE(instance, "%foo%") AND NOT LIKE(instance, "%bar%")

View solution in original post

Solution

thanks, this works
| where NOT LIKE(instance, "%foo%") AND NOT LIKE(instance, "%bar%")

I see, accept your answers.

check reference
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Where
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval

Get Updates on the Splunk Community!

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them. As ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...