Splunk Search

Removing values from a field

gagareg
Explorer

how to remove values from fields highlighted in red

index=main | eval description=case(status == 200, "OK", status == 404, "Not found", status == 500, "Internal Server Error", status == 503, "Service Unavailable", status == 406, "Not Acceptable", status == 400, "Bad Request ", status == 408, "Request Timeout", status == 505, "HTTP Version Not Supported", status == 403, "Forbidden") | table _time status description | where isnotnull(status) | dedup status

alt text

0 Karma
1 Solution

vnravikumar
Champion

Hi

Try with below

your query.... |where NOT status IN ("deferred","sent","expired","bounced")

View solution in original post

to4kawa
Ultra Champion
index=main 
| eval description=case(status == 200, "OK", status == 404, "Not found", status == 500, "Internal Server Error", status == 503, "Service Unavailable", status == 406, "Not Acceptable", status == 400, "Bad Request ", status == 408, "Request Timeout", status == 505, "HTTP Version Not Supported", status == 403, "Forbidden", true(), NULL)
| table _time status description
| where isnotnull(description) 
| dedup status
0 Karma

gagareg
Explorer

Unfortunately, it does not work for me. But thank you for answering

0 Karma

vnravikumar
Champion

Hi

Try with below

your query.... |where NOT status IN ("deferred","sent","expired","bounced")

gagareg
Explorer

Thanks. It's working

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...