Splunk Search

Search to filter data

Explorer

Hi, Can I write my search as:

index=idx1 host != (a,b,c) | stats count by host

The thing is I want to filter some of the hosts in the count.

0 Karma
1 Solution

Esteemed Legend

You can do this:

index="idx1" AND NOT host IN("a","b","c")
| stats count by host

View solution in original post

Esteemed Legend

You can do this:

index="idx1" AND NOT host IN("a","b","c")
| stats count by host

View solution in original post