Solved: Re: Search to filter data - Splunk Community

Splunk Search

Hi, Can I write my search as:

index=idx1 host != (a,b,c) | stats count by host

The thing is I want to filter some of the hosts in the count.

1 Solution

Solution

You can do this:

index="idx1" AND NOT host IN("a","b","c")
| stats count by host

View solution in original post

Solution

You can do this:

index="idx1" AND NOT host IN("a","b","c")
| stats count by host

Get Updates on the Splunk Community!

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...