Splunk Search

filter a table result

trifledalliance
Engager

Hi - i'm not great at Splunk and am struggling with this one:

I have this search result in table form

NameStatus
Server1OK
Server2OK
Server1Deleted
Server2OK
Server3Discovered

I'd like to filter out any servers that have status deleted so for the example i'd like

NameStatus
Server2OK
Server3Discovered

Thanks for any help.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Using just the where command to filter results just removes one Server1 event rather than all of them.

Instead, you can use the eventstats command to associated the Deleted status with all events from the same server.  Then filter on that association.

| eventstats count(eval(Status="Deleted")) as is_deleted by Name
| where is_deleted=1
| fields - is_deleted

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Using just the where command to filter results just removes one Server1 event rather than all of them.

Instead, you can use the eventstats command to associated the Deleted status with all events from the same server.  Then filter on that association.

| eventstats count(eval(Status="Deleted")) as is_deleted by Name
| where is_deleted=1
| fields - is_deleted

 

---
If this reply helps you, Karma would be appreciated.

trifledalliance
Engager

That works nicely thanks @richgalloway  I just had to tweak the where to get the list of undeleted.

| eventstats count(eval(Status="Deleted")) as is_deleted by Name
| where is_deleted=0 | table Name is_deleted Status

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...