Splunk Search

Removing values from a field

gagareg
Explorer

how to remove values from fields highlighted in red

index=main | eval description=case(status == 200, "OK", status == 404, "Not found", status == 500, "Internal Server Error", status == 503, "Service Unavailable", status == 406, "Not Acceptable", status == 400, "Bad Request ", status == 408, "Request Timeout", status == 505, "HTTP Version Not Supported", status == 403, "Forbidden") | table _time status description | where isnotnull(status) | dedup status

alt text

0 Karma
1 Solution

vnravikumar
Champion

Hi

Try with below

your query.... |where NOT status IN ("deferred","sent","expired","bounced")

View solution in original post

to4kawa
Ultra Champion
index=main 
| eval description=case(status == 200, "OK", status == 404, "Not found", status == 500, "Internal Server Error", status == 503, "Service Unavailable", status == 406, "Not Acceptable", status == 400, "Bad Request ", status == 408, "Request Timeout", status == 505, "HTTP Version Not Supported", status == 403, "Forbidden", true(), NULL)
| table _time status description
| where isnotnull(description) 
| dedup status
0 Karma

gagareg
Explorer

Unfortunately, it does not work for me. But thank you for answering

0 Karma

vnravikumar
Champion

Hi

Try with below

your query.... |where NOT status IN ("deferred","sent","expired","bounced")

gagareg
Explorer

Thanks. It's working

0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...