Splunk Search

How do I exclude multiple specific fields from search results?

bcdatacomm
Explorer

I have a saved search that I alert on and there is certain events I don't want the alert to trigger for when it's coming from inside my network.

Basically I have a this saved search:
index=pan_logs (log_subtype=vulnerability OR log_subtype=wildfire) | fields action, severity, CATEGORY, SUBCATEGORY, direction, dst_hostname, dst_ip, dst_user, dst_zone, log_subtype, misc, rule_name, sourcetype, src_ip, src_zone, threat_name, url, protocol, server_location

It sends me all the alerts we want to see, but there is a couple alerts I don't care about. Especially ones that come from "src_zone=inside + dst_zone=outside + threat_name=IIS DDOS"

So, how do I get my search to display everything except the events that are from inside to outside and the threat name is IIS DDOS?

Tags (2)
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Have you tried this?

index=pan_logs (log_subtype=vulnerability OR log_subtype=wildfire) NOT (src_zone=inside AND dst_zone=outside AND threat_name=IIS DDOS) | fields action, severity, CATEGORY, SUBCATEGORY, direction, dst_hostname, dst_ip, dst_user, dst_zone, log_subtype, misc, rule_name, sourcetype, src_ip, src_zone, threat_name, url, protocol, server_location
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Have you tried this?

index=pan_logs (log_subtype=vulnerability OR log_subtype=wildfire) NOT (src_zone=inside AND dst_zone=outside AND threat_name=IIS DDOS) | fields action, severity, CATEGORY, SUBCATEGORY, direction, dst_hostname, dst_ip, dst_user, dst_zone, log_subtype, misc, rule_name, sourcetype, src_ip, src_zone, threat_name, url, protocol, server_location
---
If this reply helps you, Karma would be appreciated.

bcdatacomm
Explorer

That worked! Thanks!

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...