Solved: Re: Search to filter data - Splunk Community

Splunk Search

Hi, Can I write my search as:

index=idx1 host != (a,b,c) | stats count by host

The thing is I want to filter some of the hosts in the count.

1 Solution

Solution

You can do this:

index="idx1" AND NOT host IN("a","b","c")
| stats count by host

View solution in original post

Solution

You can do this:

index="idx1" AND NOT host IN("a","b","c")
| stats count by host

Get Updates on the Splunk Community!

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them. As ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...