Splunk - excluding fields which contain certain values

[nickhaj]

I want to exclude events within my search which have a field (Message) which may contain certain values;
so my Search is currently :
index=a OR index=b SourceName=a OR sourcetype =a ERROR OR FAIL OR FAILED OR FAILURE
| where NOT (Action="Fail.") AND NOT (Message=getservbyname) AND NOT (Message=UDP)

The above doesnt work obviously, but the first bit (Action="Fail.") exclusion works OK on its own; so I'm looking for the syntax which will make the Message field includes values 'getservbyname' OR 'UDP' exclusions work too. The "Message" field is a long text field hence trying to filter these out using Key Values getservbyname and UDP.

Many Thanks for any assistance!

[nickhaj]

HI - that seems to have done the trick !!! MANY Thanks for your input !

[FrankVl]

Assuming that comment belongs to my answer: you're welcome. Please mark the answer as accepted, so it is clear your question has been answered 🙂

[FrankVl · Accepted solution]

try:

(index=a OR index=b) (SourceName=a OR sourcetype =a) (ERROR OR FAIL OR FAILED OR FAILURE) Action!="FAIL." Message!=*getservbyname* Message!=*UDP*

Note: I just added those parentheses to make it a little easier to read, those are not necessary.
Note2: this will only show results that do have some value in Action and Message field. If you also want to include events where those fields are empty, then use NOT Action="Fail." NOT Message=*getservbyname* NOT Message=*UDP* instead of the != operator.

[nickhaj]

I did some tests adding one of the NOT statements at a time and the amount of events returned reduced accordingly each time, so i'm 99.99% sure the revisions suggested are doing the job.....but will monitor over the next week to be 100% certain 🙂