Splunk Search

Omit an error code from a search

NikitaY
Engager

Hi all,

We are using one of the built-in search commands to look at the errors in the past 24 hours. However there are a lot of events with Error Code 0x0 that are showing up; 0x0 isn't really an error, so it's not useful having it there. Is there any way that we can omit this error code from the search?

This is the search entry: error OR failed OR severe OR ( sourcetype=access_* ( 404 OR 500 OR 503 ) )

Tags (2)
0 Karma
1 Solution

splunk68
Path Finder

Hello,

you could try the following:

error OR failed OR severe OR (sourcetype=access_* (404 OR 500 OR 503)) NOT Error_Code="0x0*"

"NOT" will exclude the field "Error_Code" containing a code starting with "0x0"

View solution in original post

splunk68
Path Finder

Hello,

you could try the following:

error OR failed OR severe OR (sourcetype=access_* (404 OR 500 OR 503)) NOT Error_Code="0x0*"

"NOT" will exclude the field "Error_Code" containing a code starting with "0x0"

NikitaY
Engager

That did the trick. Thank you.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...