Solved: Re: Search to filter data - Splunk Community

Splunk Search

Hi, Can I write my search as:

index=idx1 host != (a,b,c) | stats count by host

The thing is I want to filter some of the hosts in the count.

1 Solution

Solution

You can do this:

index="idx1" AND NOT host IN("a","b","c")
| stats count by host

View solution in original post

Solution

You can do this:

index="idx1" AND NOT host IN("a","b","c")
| stats count by host

Get Updates on the Splunk Community!

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Introducing the 2026 - 2027 SplunkTrust cohort!

The goal of the SplunkTrust™ membership has historically been to acknowledge and recognize those who go above ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...