Splunk Search

Search NOT contain

NayneshP
Observer

I'm trying to create an SPL which will give me the results as per below:

Search for all users for have visited "store.com" but for those user who visited nzcompany.com then don't display that user in a table. (although they did visit store.com)

UserURL
Bradstore.com
Tom store.com
Bartnzcompany.com
Lisastore.com
Bartstore.com
Tom store.com
Lisastore.com
Lisanzcompany.com
Lisastore.com
  
Results 
Tom 
Brad 

 

i tried to do this but didnt work

index=network (url=store.com AND url!=nzcompany.com)

|  table user

 

Thanks

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| chart count by User URL
| where 'store.com' > 0 AND 'nzcompany.com' == 0
Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk + Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...