Solved: search query - Splunk Community

Splunk Search

What is wrong with the following?

index="app" | top productName NOT productName = "Not Specified"

I want to extract a list of product names but I don't want to include "Not Specified" as part of the set.

TIA

1 Solution

Solution

Try excluding "not specified" in the original search string, before calling the top command. Also, use !=

index="app" productName!="Not Specified" | top productName

View solution in original post

Solution

Try excluding "not specified" in the original search string, before calling the top command. Also, use !=

index="app" productName!="Not Specified" | top productName

Get Updates on the Splunk Community!

Unlocking Unified Insights: New Gigamon Federated Search App for Splunk

In today’s data-heavy environment, organizations are caught in a data distribution dilemma. As data volumes ...

GA: New Data Management App in Splunk Platform

Streamlining Data Management: Introducing a unified experience in Splunk Managing data at scale shouldn’t feel ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...