Splunk Search

removing more than one field value conditionally

TaraAshley
Engager

I am working on a query that lists hosts and their corresponding instances. My results look like the example below. 

I want to only remove the 111222 host when the instance is R: from my results. I am not certain on how to do this within my query. 

HostInstance
111222A:
111222C:
111222R:
333444A:
333444C:
333444R:
Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

"111222 host when the instance is R:" is ambiguous.  You should include an illustration of desired results in a question.

1. The most literal interpretation is to only remove the row with host 111222 AND Instance R:.  In other words, you want

Instancehost
A:111222
C:111222
A:333444
C:333444
R:333444

For this, you can do 

 

 

| where NOT ( host == "111222" AND Instance == "R:")

 

 

BTW I don't think you should rename host to Host until everything is done.

2. But your context makes me suspect that you actually mean to remove host 111222 IF Instance R: runs on it and no matter what other instances are there.  In other words, you want

Instance
R_or_not_R
host
A:
A:
C:
R:
333444
C:
A:
C:
R:
333444
R:
A:
C:
R:
333444

For this, you need

 

 

| eventstats values(Instance) as R_or_not_R by host
| where host != "111222" OR R_or_not_R != "R:"​

 

 

Which one is it?

Here is an emulation

 

| makeresults format=csv data="host,	Instance
111222,	A:
111222,	C:
111222,	R:
333444,	A:
333444,	C:
333444,	R:"
``` data emulation above ```

 

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...