Splunk Search

Pull data only for the models that I want to pull data

bzsplunk54
New Member

Hello , If I have models that are KV800 and other models that are advancements to this model as in KV800-48S or KV800X-32P. How do I display only the KV800 items and not the KV800-48S OR KV800X-32P. I know I can use equipment=KV800 NOT KV800-48S NOT KV800X-32P but is there an easier more effective way to accomplish this task. Let's say I have alot of variation of the KV800 and I'd rather not have a huge search string to accomplish this task.

index=inventory (equipment = KV800 NOT equipment="KV800-48S NOT equipment="KV800X-32P)

thanks

Tags (3)
0 Karma

sduff_splunk
Splunk Employee
Splunk Employee

index=inventory equipment = KV800
would be sufficient

0 Karma

bzsplunk54
New Member

thanks for responding. I should have added the other characters to the name format as the above suggestion will not work for me. The model KV800 is actually KV800-38T-S. The other models would be KV800X-32P-E and KV800G-48PF-S. From the above I can do KV800* however this gives me everything and I have many other KV800 models and I only want to search an entire inventory and pull out the KV800 models as these are the base models. any further info would be appreciated.

0 Karma

sduff_splunk
Splunk Employee
Splunk Employee

index=inventory equipment = KV800-*

0 Karma

bzsplunk54
New Member

this still will display all the models. I'll just search for NOT with the other IOS models until the only model are the KV800. appreciate the feeback

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...