Splunk Search

Splunk - excluding fields which contain certain values

nickhaj
New Member

I want to exclude events within my search which have a field (Message) which may contain certain values;
so my Search is currently :
index=a OR index=b SourceName=a OR sourcetype =a ERROR OR FAIL OR FAILED OR FAILURE
| where NOT (Action="Fail.") AND NOT (Message=getservbyname) AND NOT (Message=UDP)

The above doesnt work obviously, but the first bit (Action="Fail.") exclusion works OK on its own; so I'm looking for the syntax which will make the Message field includes values 'getservbyname' OR 'UDP' exclusions work too. The "Message" field is a long text field hence trying to filter these out using Key Values getservbyname and UDP.

Many Thanks for any assistance!

Tags (1)
0 Karma
1 Solution

FrankVl
Ultra Champion

try:

(index=a OR index=b) (SourceName=a OR sourcetype =a) (ERROR OR FAIL OR FAILED OR FAILURE) Action!="FAIL." Message!=*getservbyname* Message!=*UDP*

Note: I just added those parentheses to make it a little easier to read, those are not necessary.
Note2: this will only show results that do have some value in Action and Message field. If you also want to include events where those fields are empty, then use NOT Action="Fail." NOT Message=*getservbyname* NOT Message=*UDP* instead of the != operator.

View solution in original post

0 Karma

nickhaj
New Member

HI - that seems to have done the trick !!! MANY Thanks for your input !

0 Karma

FrankVl
Ultra Champion

Assuming that comment belongs to my answer: you're welcome. Please mark the answer as accepted, so it is clear your question has been answered 🙂

0 Karma

FrankVl
Ultra Champion

try:

(index=a OR index=b) (SourceName=a OR sourcetype =a) (ERROR OR FAIL OR FAILED OR FAILURE) Action!="FAIL." Message!=*getservbyname* Message!=*UDP*

Note: I just added those parentheses to make it a little easier to read, those are not necessary.
Note2: this will only show results that do have some value in Action and Message field. If you also want to include events where those fields are empty, then use NOT Action="Fail." NOT Message=*getservbyname* NOT Message=*UDP* instead of the != operator.

0 Karma

nickhaj
New Member

I did some tests adding one of the NOT statements at a time and the amount of events returned reduced accordingly each time, so i'm 99.99% sure the revisions suggested are doing the job.....but will monitor over the next week to be 100% certain 🙂

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...