Negate the field containing both the values in SPLUNK query

[Janani_Krish]

Hi,

I have written following query where a field consisting of 2 actions as below,

Query:
sourcetype="my_sourcetype" session_id="1011" |eval indicator=mvappend(src,dest)|mvexpand indicator|stats count values(action) by indicator,session_id

Result:

indicator	session_id	count	value(action)
23.45.6.78	1011	2	allowed teared
23.45.6.79	1045	2	allowed

Now I want to negate the field which contain both allowed and teared. Please suggest any ideas.

[richgalloway]

Like this, maybe?

sourcetype="my_sourcetype" session_id="1011" 
| eval indicator=mvappend(src,dest)
| mvexpand indicator
| stats count values(action) as actions by indicator,session_id
| where (isnull(mvfind(actions,"allowed")) AND isnull(mvfind(actions,"teared")))