Splunk Search

Removing values from a field

gagareg
Explorer

how to remove values from fields highlighted in red

index=main | eval description=case(status == 200, "OK", status == 404, "Not found", status == 500, "Internal Server Error", status == 503, "Service Unavailable", status == 406, "Not Acceptable", status == 400, "Bad Request ", status == 408, "Request Timeout", status == 505, "HTTP Version Not Supported", status == 403, "Forbidden") | table _time status description | where isnotnull(status) | dedup status

alt text

0 Karma
1 Solution

vnravikumar
Champion

Hi

Try with below

your query.... |where NOT status IN ("deferred","sent","expired","bounced")

View solution in original post

to4kawa
Ultra Champion
index=main 
| eval description=case(status == 200, "OK", status == 404, "Not found", status == 500, "Internal Server Error", status == 503, "Service Unavailable", status == 406, "Not Acceptable", status == 400, "Bad Request ", status == 408, "Request Timeout", status == 505, "HTTP Version Not Supported", status == 403, "Forbidden", true(), NULL)
| table _time status description
| where isnotnull(description) 
| dedup status
0 Karma

gagareg
Explorer

Unfortunately, it does not work for me. But thank you for answering

0 Karma

vnravikumar
Champion

Hi

Try with below

your query.... |where NOT status IN ("deferred","sent","expired","bounced")

gagareg
Explorer

Thanks. It's working

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...