Splunk Search

How to use "where" and "not in" and "like" in one query?

JyotiP
Path Finder

I have the following query :
sourcetype="docker" AppDomain=Eos Level=INFO Message="Eos request calculated" | eval Val_Request_Data_Fetch_RefData=Round((Eos_Request_Data_Fetch_MarketData/1000),1)

Which have 3 host like perf, castle, local.

I want to use the above query bust excluding host like castle and local

sourcetype="docker" AppDomain=Eos Level=INFO Message="Eos request calculated" | eval Val_Request_Data_Fetch_RefData=Round((Eos_Request_Data_Fetch_MarketData/1000),1) | where host NOT like 'castle' AND 'local' ??
Will it work

Labels (1)
0 Karma
1 Solution

HiroshiSatoh
Champion

Try this!

sourcetype="docker" AppDomain=Eos Level=INFO Message="Eos request calculated" NOT (host='castle' OR  host='local')

This is also possible.

NOT (host='*castle*' OR  host='*local*')

View solution in original post

cmerriman
Super Champion

to wildcard NOT, you can do like what @HiroshiSatoh mentioned and go with

sourcetype="docker" AppDomain=Eos Level=INFO Message="Eos request calculated" NOT (host=*castle* OR  host=*local* OR host=*perf*)| eval Val_Request_Data_Fetch_RefData=Round((Eos_Request_Data_Fetch_MarketData/1000),1)

which will remove the hosts that contain perf, castle, or local from the base search
or if you need to remove it later on in the search, after doing evals/stats with it, perhaps, using where and like would be like this:

...|where NOT like(host,"%perf%") AND NOT like(host,"%castle%") AND NOT like(host,"%local%")

HiroshiSatoh
Champion

Try this!

sourcetype="docker" AppDomain=Eos Level=INFO Message="Eos request calculated" NOT (host='castle' OR  host='local')

This is also possible.

NOT (host='*castle*' OR  host='*local*')

abbasimani
New Member

You can also use: 

 

NOT (host IN (*castle*,*local*))

 

So full query will be something like this: 

sourcetype="docker" AppDomain=Eos Level=INFO Message="Eos request calculated" NOT (host IN (*castle*,*local*)) 
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...