Splunk Search

ignoring extracted value

sumitnagal
Path Finder

I want to ignore certain search results from by search. Now one way is below where I can filter the extracted value, which I am using currently. This is not the great solution though, as I already have around 6-7 filter in search command. Now adding more will create a big problem for me. as every time i need to add using new pipe.

some search string | eval puserid = mvfilter(puserid != 211930670 ) | eval puserid = mvfilter(puserid != 212327191 ) | eval puserid = mvfilter(puserid != 211896322 ) | eval puserid = mvfilter(puserid != 212327208 | stats 

somehow this is working fine, till I come to another use case where I need to ignore these values on daily basis. Now I have created n searches and on top of that a Dashboard. going modifying one by one is time consuming. Also, that is not viable solution. I am looking for a solution, where I can pass information which can be ignored from extracted results and I need not to modify my searches.

Tags (3)

sumitnagal
Path Finder

I have used lookup which has solved the problem, but now everytime I need to update lookup.csv file. Currently I am deleting existing lookup file and uploading new lookup file with values.

0 Karma

sumitnagal
Path Finder

the only problem is I am getting puserid from a search string, hence I am thinking of using like this way

some search string |rex field=_raw " (?[^ ]) (?[A-Za-z]) (?[^ ]) (?[^ ]) " | eval puserid = mvfilter(puserid != 211930670 ) | eval puserid = mvfilter(puserid != 212327191 ) | eval puserid = mvfilter(puserid != 211896322 ) | eval puserid = mvfilter(puserid != 212327208 | stats

let me know, if there are better ways to do so.

Also, in your suggestion every time I need to add puserid, which I want to ignore in my use case.

0 Karma

araitz
Splunk Employee
Splunk Employee

I'm not sure I understand why your are using eval as such, as it is suboptimal. As a rule of thumb, filtering should be performed before the first pipe symbol.

some search string NOT puserid=211930670 NOT puserid=212327191 ... | stats ...

A more efficient solution would be to use a lookup or eventtypes and tags to manage the list of puserid that you want to exclude.

Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...