Splunk Search

Omit an error code from a search

NikitaY
Engager

Hi all,

We are using one of the built-in search commands to look at the errors in the past 24 hours. However there are a lot of events with Error Code 0x0 that are showing up; 0x0 isn't really an error, so it's not useful having it there. Is there any way that we can omit this error code from the search?

This is the search entry: error OR failed OR severe OR ( sourcetype=access_* ( 404 OR 500 OR 503 ) )

Tags (2)
0 Karma
1 Solution

splunk68
Path Finder

Hello,

you could try the following:

error OR failed OR severe OR (sourcetype=access_* (404 OR 500 OR 503)) NOT Error_Code="0x0*"

"NOT" will exclude the field "Error_Code" containing a code starting with "0x0"

View solution in original post

splunk68
Path Finder

Hello,

you could try the following:

error OR failed OR severe OR (sourcetype=access_* (404 OR 500 OR 503)) NOT Error_Code="0x0*"

"NOT" will exclude the field "Error_Code" containing a code starting with "0x0"

NikitaY
Engager

That did the trick. Thank you.

0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...