Splunk Search

Removing values from a field

gagareg
Explorer

how to remove values from fields highlighted in red

index=main | eval description=case(status == 200, "OK", status == 404, "Not found", status == 500, "Internal Server Error", status == 503, "Service Unavailable", status == 406, "Not Acceptable", status == 400, "Bad Request ", status == 408, "Request Timeout", status == 505, "HTTP Version Not Supported", status == 403, "Forbidden") | table _time status description | where isnotnull(status) | dedup status

alt text

0 Karma
1 Solution

vnravikumar
Champion

Hi

Try with below

your query.... |where NOT status IN ("deferred","sent","expired","bounced")

View solution in original post

to4kawa
Ultra Champion
index=main 
| eval description=case(status == 200, "OK", status == 404, "Not found", status == 500, "Internal Server Error", status == 503, "Service Unavailable", status == 406, "Not Acceptable", status == 400, "Bad Request ", status == 408, "Request Timeout", status == 505, "HTTP Version Not Supported", status == 403, "Forbidden", true(), NULL)
| table _time status description
| where isnotnull(description) 
| dedup status
0 Karma

gagareg
Explorer

Unfortunately, it does not work for me. But thank you for answering

0 Karma

vnravikumar
Champion

Hi

Try with below

your query.... |where NOT status IN ("deferred","sent","expired","bounced")

gagareg
Explorer

Thanks. It's working

0 Karma
Get Updates on the Splunk Community!

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...