Splunk Search

Splunk query to eliminate specific events

alexspunkshell
Contributor

Hi,

Below is my splunk search query & Screenshot. I want eliminate TrustedLocation = "Zscaler Miami III" from my result.

Please help me with splunk query. I tried but unable to acheive it.

index=test "vendorInformation.provider"=IPC
| eval Event_Date=mvindex('eventDateTime',0)
| eval UPN=mvindex('userStates{}.userPrincipalName',0)
| eval Logon_Location=mvindex('userStates{}.logonLocation',0)
| eval Event_Title=mvindex('title',0)
| eval Event_Severity=mvindex('severity',0)
| eval AAD_Acct=mvindex('userStates{}.aadUserId',0)
| eval LogonIP=mvindex('userStates{}.logonIp',0)
| eval Investigate=+"https://portal.azure.com/#blade/Microsoft_AAD_IAM/RiskyUsersBlade/userId/".AAD_Acct
| stats count by Event_Date, Event_Title, Event_Severity UPN Logon_Location LogonIP Investigate
| lookup WeirMFAStatusLookup.csv userPrincipalName as UPN
| lookup Lookup_EMPADInfo.csv userPrincipalName as UPN
| lookup WeirSiteCode2IP.csv public_ip as LogonIP
| lookup ZscalerIP CIDR_IP as LogonIP
| lookup WeirTrustedIPs.csv TrustedIP as LogonIP
| fillnull value="Unknown Site" site_code
| eval AD_Location=st + ", " + c
| fillnull value="OK" MFAStatus
| eval TrustedLocation=if(isnull(TrustedLocation), ZLocation, TrustedLocation)
| rename site_code as LogonSiteCode
| table Event_Date, Event_Title, Event_Severity UPN LogonIP LogonSiteCode Logon_Location AD_Location TrustedLocation MFAStatus count Investigate
| sort - Event_Date

alexspunkshell_1-1608637515737.png

@soutamo @ITWhisperer @gcusello @thambisetty @richgalloway @to4kawa 

 

Labels (5)
Tags (1)
0 Karma

alexspunkshell
Contributor

@saravanan90  Thanks for your reply.

Search result's count is mismatching.

It should give 45 counts without "Zscaler Miami III "but i am getting only 30 values as result.

0 Karma

saravanan90
Contributor

Check if the below works.

| makeresults count=10| streamstats count| eval TrustedLocation="Zscaler Miami III"| eval TrustedLocation=if(count%2=0,TrustedLocation,"otherdata") | search TrustedLocation!="Zscaler Miami III"

-----------------------------------------

An upvote would be appreciated if the above reply is useful to you.

 

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...