Removing rows from table based on more than one field

[kxmorrr]

Hi,

I am trying to filter out fields from a table based on its content, example:

LP. NAME SURNAME STREET CITY
1. Bob Smith mainst florida
2. Greg Obama secondaryst miami

I want to remove second row from table based on fact that it have "Greg" AND "Miami" in name and city fields.

So far I tried:
|search Name NOT "Greg" AND City NOT "Miami"
but it didnt work for me. Any ideas?

[PickleRick · Accepted solution]

Depends on what you want to get. But your

|search Name NOT "Greg" AND City NOT "Miami"

means something different that you want.

If you don't compare field names to a value (might be a wildcard), splunk treats it as an ordinary text to search. Also, if you don't specify other operations, you have implied AND, so your search is equal to

|search "Name" AND NOT "Greg" AND "City" AND NOT "Miami"

It's definitely not what you want.

You want (depending on the desired outcome)

| search Name!="Greg" AND City!="Miami"

 or maybe

| search Name!="Greg" OR City!="Miami"

Depending on whether you want to filter out one or both possibilities at the same time.

And remember that with splunk A!=B is not the same as NOT A=B

[kxmorrr]

I want to remove field if and only if both conditions are satisfied, this is when name is Greg and city is Miami, but keep the row if none or only one is satisfied, 

| search Name!="Greg" AND City!="Miami"

Removes all Gregs from the table, but I only want those living in Miami gone. 

[PickleRick]

Are you sure your field names are properly-cased? In splunk search values are case-insensitive but field names are case-sensitive.