Solved: Re: search query - Splunk Community

Splunk Search

What is wrong with the following?

index="app" | top productName NOT productName = "Not Specified"

I want to extract a list of product names but I don't want to include "Not Specified" as part of the set.

TIA

1 Solution

Solution

Try excluding "not specified" in the original search string, before calling the top command. Also, use !=

index="app" productName!="Not Specified" | top productName

View solution in original post

Solution

Try excluding "not specified" in the original search string, before calling the top command. Also, use !=

index="app" productName!="Not Specified" | top productName

Get Updates on the Splunk Community!

Event Series: Splunk Observability Metrics Cost Optimization

Balancing Scale and Spend: Gaining Control Over High-Volume Metrics in Splunk Observability Cloud As ...

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...

Deep insights, no barriers: Splunk Observability Cloud Free Edition

As software delivery cycles continue to accelerate, observability shouldn’t be a luxury — it should be a ...