Splunk Enterprise

Removing source rows based on field values.

richtate
Path Finder

I have a index with thousands of operating systems (OS).  I want to remove unwanted operating systems (OS) from my report using wild cards as many of the unwanted share the same value as part of the OS.

Here is what I'm trying to do:

earliest=-15d@d index="asset" sourcetype="Tenable:SecurityCenter:Asset"
WHERE operating_system NOT "[APC*" OR "[AIX*"
| stats count by operating_system

I want to remove OS that have APC or AIX ( and others not listed) from the query.  But I can't use a wildcard which would mean hundreds of entries just for APC and all the versions I want to exclude.  I've tried NOT IN, NOT LIKE, != and more but either nothing is returned or what I want filtered out is not filtered and all events are returned.  Suggestions?

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

These operating systems don't have the leading [ which you had in your original post - try this instead

| regex operating_system!="(APC|AIX)"

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| regex operating_system!="^\[(APC|AIX)"
0 Karma

richtate
Path Finder

I gave that a try and still getting those OS returned:

richtate_0-1632263222509.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

These operating systems don't have the leading [ which you had in your original post - try this instead

| regex operating_system!="(APC|AIX)"
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...