My Splunk Query
index= index1 sourceType=source1 "Error" OR requestURl != "/test/abc" OR requestURI != "/person" OR requestURI != "error.php"
but still im getting the requestURI in my search result.
Im intersted in those events that have error .
Every error message will match your query because they will all pass at least one of the requestURI tests. Try this query instead. It will display all errors except those from "/test/abc", "/person", and "error.php".
index= index1 sourceType=source1 "Error" (requestURl != "/test/abc" AND requestURI != "/person" AND requestURI != "*error.php")
LIke this:
index="index1" sourceType="source1" Error AND NOT (requestURl="/test/abc" OR requestURI="/person" OR requestURI="error.php")
Thank you
Every error message will match your query because they will all pass at least one of the requestURI tests. Try this query instead. It will display all errors except those from "/test/abc", "/person", and "error.php".
index= index1 sourceType=source1 "Error" (requestURl != "/test/abc" AND requestURI != "/person" AND requestURI != "*error.php")
Thank you