Splunk Search

excluding a field value from a same events

rajiv_r
Explorer

How can i exclude a single value from a field which generates multiple value in the single event.
for eg- if in a single event there are two values for the same field - user.purchase="TRUE" and user.purchase="False". If i have to exclude user.purchase="False' and need to display only user.purchase= " True" how can i do it.
I have already tried search user.purchase != "False" --- It dint worked.
I have also tried with NOT operator and Where command but nothing worked out.
Can someone please help me excluding this value

Labels (1)
Tags (1)
0 Karma
1 Solution

to4kawa
Ultra Champion
....
|rex mode=sed field="user.purchase" "s/false//g"

View solution in original post

0 Karma

to4kawa
Ultra Champion
....
|rex mode=sed field="user.purchase" "s/false//g"
0 Karma

rajiv_r
Explorer

Thanks a lot this works

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try "user.purchase" != "false".

---
If this reply helps you, Karma would be appreciated.
0 Karma

rajiv_r
Explorer

I had already tried it..it dint work

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...