Hello, splunk newbie here,
I have tens of servers named like abc01, abc02 .... abc20. Now i would like to search for events on a subset of these machines like for example only the abc18 and abc19. I'm trying searches like
index="prd_access" sourcetype="access:web:foo" earliest=-7d latest=now | regex "abc(18|19)"
This seems to work but how can i select data from everything except these "abc(18|19)" ?
host!="abc(18|19)"
doesn't seem to work..
Thanks in advance,
Bert
you can try using following query
index="prd_access" sourcetype="access:web:foo" earliest=-7d latest=now | search NOT ("abc18" OR "abc19")
I would use the following:
index="prd_access" sourcetype="access:web:foo" earliest=-7d latest=now NOT host=abc18 NOT host=abc19
There's not a need to run a second search via the | operator, just go ahead and filter out those hosts in the first search command.
Will give it a try, thanks!