Getting Data In

Exclude events with specific field value from results


How would I exclude all events which contain a specific field value from a set of search results?

For instance:
source="mysource" | sort -_time | table UserLoginName _time | dedup UserLoginName

Gives me a table of usernames and last login time.

I'd like to filter out one of the users (say, SYSTEM) from the results...

Tags (1)

Splunk Employee
Splunk Employee

You could simply add the search term "UserLoginName!=SYSTEM" or "NOT UserLoginName=SYSTEM" to the first command of your search :

source="mysource" UserLoginName!="SYSTEM" | sort -_time | table UserLoginName _time | dedup UserLoginName

If you are curious to find out more about the search language and its syntax, I recommend to consult our search tutorial :

Get Updates on the Splunk Community!

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...