Splunk Search

Unable to Seam Together Tstats and "!=" Operator

LionelHutz
Engager

Hello Hello,

Trying to make this search work:

| tstats allow_old_summaries=true dc(Malware_Attacks.signature) as "infection_count" from datamodel=Malware where ((Malware_Attacks.file_path!="C:\ProgramData\Adobe*") nodename=Malware_Attacks) by "Malware_Attacks.dest", "Malware_Attacks.file_path"
| rename "Malware_Attacks.dest" as "dest"
| where 'infection_count'>1

(The goal being to exclude any event which has a file path containing "C:\ProgramData\Adobe\*").

I'm open to the NOT operator instead of !=.  I've tried a handful of different ways of wording this query, but can't get it to produce what I want.

Thank you to whoever can shed light on this!

 

Labels (2)
0 Karma

LionelHutz
Engager

I figured it out, here is the answer in case anyone ever needs it!

| tstats allow_old_summaries=true dc(Malware_Attacks.signature) as "infection_count" FROM datamodel=Malware WHERE (nodename=Malware_Attacks "Malware_Attacks.file_path"!="**Adobe**") by "Malware_Attacks.dest", "Malware_Attacks.file_path"
| rename "Malware_Attacks.dest" as "dest"
| where 'infection_count'>1

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.