Splunk Search

Use of NOT operator

lbogle
Contributor

Hello Splunkers,
I'm trying to run a search against some logs that include a wild carded hostname, two error messages but exclude two IP addresses. I have the first parts down but excluding the IP addresses isn't quite working out. What am I doing wrong here? (IP's modified for the post)

host="*-contlr-wl.Domain.COM" error OR fail* admin NOT (123.123.123.123 AND 456.456.456.456)

So I'm getting all reports from contlr-wl machines.
I'm getting all the messages that have either error OR fail* in them
But the two IP addresses are still showing up. How do I exclude those from my search?
Thanks everyone.

Tags (2)
0 Karma
1 Solution

lukejadamec
Super Champion

You are telling the search engine to only exclude the IPs if they both appear in the same event.

Try

NOT "*123.123.123.123*" NOT "*456.456.456.456*"

View solution in original post

lukejadamec
Super Champion

You are telling the search engine to only exclude the IPs if they both appear in the same event.

Try

NOT "*123.123.123.123*" NOT "*456.456.456.456*"

lbogle
Contributor

Awesome! That did it!
Thanks!

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>