Splunk Search

Pull data only for the models that I want to pull data

bzsplunk54
New Member

Hello , If I have models that are KV800 and other models that are advancements to this model as in KV800-48S or KV800X-32P. How do I display only the KV800 items and not the KV800-48S OR KV800X-32P. I know I can use equipment=KV800 NOT KV800-48S NOT KV800X-32P but is there an easier more effective way to accomplish this task. Let's say I have alot of variation of the KV800 and I'd rather not have a huge search string to accomplish this task.

index=inventory (equipment = KV800 NOT equipment="KV800-48S NOT equipment="KV800X-32P)

thanks

Tags (3)
0 Karma

sduff_splunk
Splunk Employee
Splunk Employee

index=inventory equipment = KV800
would be sufficient

0 Karma

bzsplunk54
New Member

thanks for responding. I should have added the other characters to the name format as the above suggestion will not work for me. The model KV800 is actually KV800-38T-S. The other models would be KV800X-32P-E and KV800G-48PF-S. From the above I can do KV800* however this gives me everything and I have many other KV800 models and I only want to search an entire inventory and pull out the KV800 models as these are the base models. any further info would be appreciated.

0 Karma

sduff_splunk
Splunk Employee
Splunk Employee

index=inventory equipment = KV800-*

0 Karma

bzsplunk54
New Member

this still will display all the models. I'll just search for NOT with the other IOS models until the only model are the KV800. appreciate the feeback

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...