Splunk Search

Splunk searching Syntax

keyu921
Explorer

Resolved

Labels (2)
0 Karma

gcusello
Legend

Hi @keyu921,

sorry, what's the question?

does your search run or doesn't give you the waiting for results?

Could you share what you would have and what yu really have with this search?

viewing you search I see that you could optimize it but it doesn't seem to be wrong

index=windows host=* EventCode=19  NOT (TaskCategory="Windows Update Agent" OR
Message="*Update for Microsoft Defender Antivirus*" OR Message="*Security Intelligence Update*")
| table _time host EventCode Message

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...