Splunk Search

filter a table result

trifledalliance
Engager

Hi - i'm not great at Splunk and am struggling with this one:

I have this search result in table form

NameStatus
Server1OK
Server2OK
Server1Deleted
Server2OK
Server3Discovered

I'd like to filter out any servers that have status deleted so for the example i'd like

NameStatus
Server2OK
Server3Discovered

Thanks for any help.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Using just the where command to filter results just removes one Server1 event rather than all of them.

Instead, you can use the eventstats command to associated the Deleted status with all events from the same server.  Then filter on that association.

| eventstats count(eval(Status="Deleted")) as is_deleted by Name
| where is_deleted=1
| fields - is_deleted

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Using just the where command to filter results just removes one Server1 event rather than all of them.

Instead, you can use the eventstats command to associated the Deleted status with all events from the same server.  Then filter on that association.

| eventstats count(eval(Status="Deleted")) as is_deleted by Name
| where is_deleted=1
| fields - is_deleted

 

---
If this reply helps you, Karma would be appreciated.

trifledalliance
Engager

That works nicely thanks @richgalloway  I just had to tweak the where to get the list of undeleted.

| eventstats count(eval(Status="Deleted")) as is_deleted by Name
| where is_deleted=0 | table Name is_deleted Status

Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...