Splunk Search

Trying to ignore a value based on the field

srinivasgowda
Explorer

Hello team,

 

I am trying to ignore the value "Total" if its concurrent Os_type matches "Linux"

 

Below is what I tried.

|search DataType=Executive_Summary | search OS_Type=Linux AND OS_SubType!=Total
| chart values(Servers_Skipped_Patching) as Skipped values(Servers_Failed_Patching) as Failed values(Servers_Successfully_Patching) as Successful by "OS_Type" "OS_SubType"

 

However, as I am also getting the value OS_SubType=Total from OS_Type=Windows.

 

Please let me know how I may ignore the "Total" only from Linux and not from any other OS_Type.

Labels (4)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| search OS_Type!=Linux OR OS_SubType!=Total
0 Karma

srinivasgowda
Explorer

By using OS_Type!=Linux all other OS_Subtype would be ignore from Linux and by adding OS_Subtype!=Total, Total from all other OS_Type will be ignored. And that is not what I am looking for. I need to ignore only Total coming from OS_Type=Linux

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Did you try it?

There is an OR so if the OS_Type is not Linux it will get found no matter what the OS_Subtype, or if the OS_Type is Linux, then it will only be found if the OS_Subtype is not Total.

OS_TypeOS_SubtypeFound by search
LinuxTotalNo
LinuxNot TotalYes (OS_Subtype != Total)
Not LinuxTotalYes (OS_Type != Linux)
Not LinuxNot TotalYes (OS_Type != Linux)

Is this not what you want?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...