Splunk Search

ignoring extracted value

sumitnagal
Path Finder

I want to ignore certain search results from by search. Now one way is below where I can filter the extracted value, which I am using currently. This is not the great solution though, as I already have around 6-7 filter in search command. Now adding more will create a big problem for me. as every time i need to add using new pipe.

some search string | eval puserid = mvfilter(puserid != 211930670 ) | eval puserid = mvfilter(puserid != 212327191 ) | eval puserid = mvfilter(puserid != 211896322 ) | eval puserid = mvfilter(puserid != 212327208 | stats 

somehow this is working fine, till I come to another use case where I need to ignore these values on daily basis. Now I have created n searches and on top of that a Dashboard. going modifying one by one is time consuming. Also, that is not viable solution. I am looking for a solution, where I can pass information which can be ignored from extracted results and I need not to modify my searches.

Tags (3)

sumitnagal
Path Finder

I have used lookup which has solved the problem, but now everytime I need to update lookup.csv file. Currently I am deleting existing lookup file and uploading new lookup file with values.

0 Karma

sumitnagal
Path Finder

the only problem is I am getting puserid from a search string, hence I am thinking of using like this way

some search string |rex field=_raw " (?[^ ]) (?[A-Za-z]) (?[^ ]) (?[^ ]) " | eval puserid = mvfilter(puserid != 211930670 ) | eval puserid = mvfilter(puserid != 212327191 ) | eval puserid = mvfilter(puserid != 211896322 ) | eval puserid = mvfilter(puserid != 212327208 | stats

let me know, if there are better ways to do so.

Also, in your suggestion every time I need to add puserid, which I want to ignore in my use case.

0 Karma

araitz
Splunk Employee
Splunk Employee

I'm not sure I understand why your are using eval as such, as it is suboptimal. As a rule of thumb, filtering should be performed before the first pipe symbol.

some search string NOT puserid=211930670 NOT puserid=212327191 ... | stats ...

A more efficient solution would be to use a lookup or eventtypes and tags to manage the list of puserid that you want to exclude.

Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...