Splunk Enterprise

Removing source rows based on field values.

richtate
Path Finder

I have a index with thousands of operating systems (OS).  I want to remove unwanted operating systems (OS) from my report using wild cards as many of the unwanted share the same value as part of the OS.

Here is what I'm trying to do:

earliest=-15d@d index="asset" sourcetype="Tenable:SecurityCenter:Asset"
WHERE operating_system NOT "[APC*" OR "[AIX*"
| stats count by operating_system

I want to remove OS that have APC or AIX ( and others not listed) from the query.  But I can't use a wildcard which would mean hundreds of entries just for APC and all the versions I want to exclude.  I've tried NOT IN, NOT LIKE, != and more but either nothing is returned or what I want filtered out is not filtered and all events are returned.  Suggestions?

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

These operating systems don't have the leading [ which you had in your original post - try this instead

| regex operating_system!="(APC|AIX)"

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| regex operating_system!="^\[(APC|AIX)"
0 Karma

richtate
Path Finder

I gave that a try and still getting those OS returned:

richtate_0-1632263222509.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

These operating systems don't have the leading [ which you had in your original post - try this instead

| regex operating_system!="(APC|AIX)"
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...