Getting Data In

Filtering a Search

heats
Explorer

Hi there, so I had a nice search return but I have a few bits that I don't want in the search. Really all I care about are the HTTP responses of 200 and I don't want to see anything with "WhatsUp/1.0" because that's just noise. Is there a good piece of documentation on this?

Trying to figure out what kind of web traffic is on a really old server that needs to be retired. Also, is there good documentation on this type of practice?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

You can remove events from search results by specifying filters, preferably in base search like this

index=foo sourcetype=bar http_status=200 NOT ("WhatsUp/1.0")

You can refer to Splunk search tutorial for more examples.
http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchTutorial/Usethesearchlanguage

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

You can remove events from search results by specifying filters, preferably in base search like this

index=foo sourcetype=bar http_status=200 NOT ("WhatsUp/1.0")

You can refer to Splunk search tutorial for more examples.
http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchTutorial/Usethesearchlanguage

heats
Explorer

Do you have to specify the source type?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Specifying more metadata field filters (index/host/source/sourcetype etc) in base search can optimize the performance.

0 Karma

heats
Explorer

Oh I see, it looks like status= not http_status This looks good! Thank you for the documentation!

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...