Solved: search query - Splunk Community

Splunk Search

What is wrong with the following?

index="app" | top productName NOT productName = "Not Specified"

I want to extract a list of product names but I don't want to include "Not Specified" as part of the set.

TIA

1 Solution

Solution

Try excluding "not specified" in the original search string, before calling the top command. Also, use !=

index="app" productName!="Not Specified" | top productName

View solution in original post

Solution

Try excluding "not specified" in the original search string, before calling the top command. Also, use !=

index="app" productName!="Not Specified" | top productName

Get Updates on the Splunk Community!

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability As ...