Splunk Search

Trying to use subsearch to filter records

joesrepsol
Path Finder

Looking at event data to run some eval commands... specifically on records with any "Status" value. Then once I get those events eval's done and narrowed down, I want to only see the events with Status!=Closed.

So how can I look at ALL events at the front-end of the query, then filter down to a specific xxx=yyy at the back-half of the query?

Mind has melted... ha

thanks!

joe

Tags (1)
0 Karma

woodcock
Esteemed Legend

Records with any value for field Status:

index="foo" sourcetype="bar" Status="*"

Then add this to limit to certain ones:

| search Status!="Closed"
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...