Need a help with splunk query

[jagan_vannala]

HI Team,

When i am trying to exclude one field by inserting condition sessionId!=X its not working . even though I used "NOT" condition but the field which i am trying to exclude is still showing in results. could you please help how i can exclude  particular field

host="*"  sessionId!=X 

host="*" NOT sessionId!=X 

[jagan_vannala]

If I want to exclude multiple fields by using NOT condition how can to use NOT query

NOT sessionId=X AND groupID=Y

Is this works? please suggest

[gcusello]

Hi @jagan_vannala ,

use parenthesis:

NOT (sessionId=X groupID=Y)

and the AND boolean operator isn't required.

if you have these doubt, I hint to follow the Splink Search Tutorial, that explain how to create your searches: https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchTutorial/WelcometotheSearchTutorial

Ciao.

Giuseppe

[PaulPanther]

If you only wanna see events that do not contain the field sessionId You must search as follows

host="*" NOT sessionId

[jagan_vannala]

Hi ,

I would like to exclude particular session under multiple session ID's

[gcusello]

Hi @jagan_vannala ,

sorry but it isn't still clear:

to exclude particular sessionId, choose the ones to exclude and put them in a condition

| search NOT sessionId IN (cond1, cond1, cond3)

Ciao.

Giuseppe

[gcusello]

Hi @jagan_vannala ,

maybe it's a mistyping, but in the solution with NOT you don't need to add !, in other words:

host="*" NOT sessionId=X 

Anyway, your two searchs has different results because with sessionId!=X you tale all the logs where the filed sessionId is present and hasn't the value "X",

instead with NOT sessionId=X you have all the events except the ones with sessionId=X , even if the sessionId field isn't present.

Ciao.

Giuseppe