Splunk Search

How do you exclude results based on multiple fields?

HealyManTech
Explorer

I am trying to get where I have if the _time and host are the same I exclude those results. I was thinking an eval or where statement might do it, but I can't figure out the syntax for either one.

I tried stats to count(_time) and where count is >=2 to show the results to test but it gives me no results.

Any thoughts would help.

0 Karma

saurabhkharkar
Path Finder

if you are trying to delete duplicates
eg:
2018-12-27 13:14:08 host
2018-12-27 13:14:08 host
you can use - | dedup _time host (you will have just 1 event left)

if you are trying to completely exclude the events, try using
| stats dc(host) as count by _time | where count =1

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.