Splunk Search

Omit an error code from a search

NikitaY
Engager

Hi all,

We are using one of the built-in search commands to look at the errors in the past 24 hours. However there are a lot of events with Error Code 0x0 that are showing up; 0x0 isn't really an error, so it's not useful having it there. Is there any way that we can omit this error code from the search?

This is the search entry: error OR failed OR severe OR ( sourcetype=access_* ( 404 OR 500 OR 503 ) )

Tags (2)
0 Karma
1 Solution

splunk68
Path Finder

Hello,

you could try the following:

error OR failed OR severe OR (sourcetype=access_* (404 OR 500 OR 503)) NOT Error_Code="0x0*"

"NOT" will exclude the field "Error_Code" containing a code starting with "0x0"

View solution in original post

splunk68
Path Finder

Hello,

you could try the following:

error OR failed OR severe OR (sourcetype=access_* (404 OR 500 OR 503)) NOT Error_Code="0x0*"

"NOT" will exclude the field "Error_Code" containing a code starting with "0x0"

NikitaY
Engager

That did the trick. Thank you.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...