Splunk Search

Omit an error code from a search

NikitaY
Engager

Hi all,

We are using one of the built-in search commands to look at the errors in the past 24 hours. However there are a lot of events with Error Code 0x0 that are showing up; 0x0 isn't really an error, so it's not useful having it there. Is there any way that we can omit this error code from the search?

This is the search entry: error OR failed OR severe OR ( sourcetype=access_* ( 404 OR 500 OR 503 ) )

Tags (2)
0 Karma
1 Solution

splunk68
Path Finder

Hello,

you could try the following:

error OR failed OR severe OR (sourcetype=access_* (404 OR 500 OR 503)) NOT Error_Code="0x0*"

"NOT" will exclude the field "Error_Code" containing a code starting with "0x0"

View solution in original post

splunk68
Path Finder

Hello,

you could try the following:

error OR failed OR severe OR (sourcetype=access_* (404 OR 500 OR 503)) NOT Error_Code="0x0*"

"NOT" will exclude the field "Error_Code" containing a code starting with "0x0"

NikitaY
Engager

That did the trick. Thank you.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...