Splunk Search

NOT like multiple values

rizwan0683
Path Finder

Looking to exclude certain values for field instance. How can I achieve this?
Propose code (not working)

index=abc sourcetype=xyz IncomingMessage
| rex field=source "/apps/prod/(?<instance>.*)/logs"   
| where NOT LIKE instance IN ("foo", "bar") 
Labels (2)
0 Karma
1 Solution

rizwan0683
Path Finder

thanks, this works
| where NOT LIKE(instance, "%foo%") AND NOT LIKE(instance, "%bar%")

View solution in original post

rizwan0683
Path Finder

thanks, this works
| where NOT LIKE(instance, "%foo%") AND NOT LIKE(instance, "%bar%")

to4kawa
Ultra Champion

I see, accept your answers.

0 Karma
Get Updates on the Splunk Community!

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...