Splunk Search

Splunk - excluding fields which contain certain values

nickhaj
New Member

I want to exclude events within my search which have a field (Message) which may contain certain values;
so my Search is currently :
index=a OR index=b SourceName=a OR sourcetype =a ERROR OR FAIL OR FAILED OR FAILURE
| where NOT (Action="Fail.") AND NOT (Message=getservbyname) AND NOT (Message=UDP)

The above doesnt work obviously, but the first bit (Action="Fail.") exclusion works OK on its own; so I'm looking for the syntax which will make the Message field includes values 'getservbyname' OR 'UDP' exclusions work too. The "Message" field is a long text field hence trying to filter these out using Key Values getservbyname and UDP.

Many Thanks for any assistance!

Tags (1)
0 Karma
1 Solution

FrankVl
Ultra Champion

try:

(index=a OR index=b) (SourceName=a OR sourcetype =a) (ERROR OR FAIL OR FAILED OR FAILURE) Action!="FAIL." Message!=*getservbyname* Message!=*UDP*

Note: I just added those parentheses to make it a little easier to read, those are not necessary.
Note2: this will only show results that do have some value in Action and Message field. If you also want to include events where those fields are empty, then use NOT Action="Fail." NOT Message=*getservbyname* NOT Message=*UDP* instead of the != operator.

View solution in original post

0 Karma

nickhaj
New Member

HI - that seems to have done the trick !!! MANY Thanks for your input !

0 Karma

FrankVl
Ultra Champion

Assuming that comment belongs to my answer: you're welcome. Please mark the answer as accepted, so it is clear your question has been answered 🙂

0 Karma

FrankVl
Ultra Champion

try:

(index=a OR index=b) (SourceName=a OR sourcetype =a) (ERROR OR FAIL OR FAILED OR FAILURE) Action!="FAIL." Message!=*getservbyname* Message!=*UDP*

Note: I just added those parentheses to make it a little easier to read, those are not necessary.
Note2: this will only show results that do have some value in Action and Message field. If you also want to include events where those fields are empty, then use NOT Action="Fail." NOT Message=*getservbyname* NOT Message=*UDP* instead of the != operator.

0 Karma

nickhaj
New Member

I did some tests adding one of the NOT statements at a time and the amount of events returned reduced accordingly each time, so i'm 99.99% sure the revisions suggested are doing the job.....but will monitor over the next week to be 100% certain 🙂

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...