Splunk Search

Splunk search to exclude events from field value

iamsplunker0415
Engager

Hello Splunk Community, 

I have a requirement to exclude the events from field values between  2AM-3AM everyday.
For Example Field USA has 4 values
USA = Texas, California, Washington, New York

I want to exclude the events from Washington between 2AM-3AM .However, I want them in remaining time 23 hours period. Is there a search to achieve this? 

Labels (1)
Tags (3)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

As usual, I advise against using the default date_* fields.

Firstly, they don't have to be present in every event so if you get the habit of relying on them you might be unpleasantly surprised. Secondly, they correspond to the original value of the original timestamp so it might not be aligned to your timezone.

I'd go with

<base search>
| eval hour=strftime(_time,"%H")
| where NOT (hour>=2 AND hour<=3 AND in(USA,"Washington","New York",and so on))

 

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @iamsplunker0415,

You can use "date_hour" field for filtering hours, please try below sample;

index=your_index USA="Washington" NOT date_hour IN (2,3)

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

PickleRick
SplunkTrust
SplunkTrust

As usual, I advise against using the default date_* fields.

Firstly, they don't have to be present in every event so if you get the habit of relying on them you might be unpleasantly surprised. Secondly, they correspond to the original value of the original timestamp so it might not be aligned to your timezone.

I'd go with

<base search>
| eval hour=strftime(_time,"%H")
| where NOT (hour>=2 AND hour<=3 AND in(USA,"Washington","New York",and so on))

 

iamsplunker0415
Engager

@scelikok Thank you. 

index=<myindex>
|search USA="Washington" NOT date_hour IN (2,3)
is not working it's only filtering washington not excluding events between 2-3
I also want the remanining values reported all the time.  

 

0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...