Getting Data In

how to filter by "does not equal"

Techfrogger
Explorer

I know how to filter for a specific event so, for example, I always run this:
source=wineventlog:* earliest_time=-24h "Type=Success"
But what I'd now like to do is the opposite: I'd like to eliminate all these "successes" so I can see all the rest. Since I don't know what the rest are, I can't filter by them. Can I do something like "type DOES NOT EQUAL Success"?

Tags (1)

Keysofsandiego
Path Finder

another example

foo search ... source=WinEventLog:Security | yadda yadda yadda

or the opposite

foo search ... source!=WinEventLog:Security | yadda yadda yadda

Its not easy to understand what people are saying when you are a newb as I am.

wangweibee
Explorer

"not equal " is just "!="

Ayn
Legend
your_search Type!=Success | the_rest_of_your_search

without the quotes, otherwise Splunk will literally be looking for the string "Type!=Success". Also you might want to do NOT Type=Success instead. The reason for that is that Type!=Success implies that the field "Type" exists, but is not equal to "Success". If the "Type" field doesn't exist at all, the filtering expression will not match.

kristian_kolb
Ultra Champion

Don't be so humble. Converted it to an answer for you 🙂

Marco
Communicator

@kristian_kolb 

LOL this comment made my day 8 years later

-Marco

0 Karma

sowings
Splunk Employee
Splunk Employee

It's possible that the only events with a 'Type' field defined are those where Type=Success. If that's true, then the third search (with !=) would have no field 'Type' against which to evaluate = or even !=.

Also consider absolute time frames, so that the time at which the search is executed isn't leading to different answers. Consider "yesterday" -> earliest=-1d@d latest=@d

0 Karma

Techfrogger
Explorer

So why is that when I search on
source=wineventlog:* earliest_time=-24h
I get approximately 25,000 responses and when I search on
source=wineventlog:* earliest_time=-24h "Type=Success"
I get approximately 24,000
But when I then search on
source=wineventlog:* earliest_time=-24h "Type!=Success"
I get zero responses? I should get back approximately 1,000 responses. What am I doing wrong?

0 Karma

sowings
Splunk Employee
Splunk Employee

It's as simple as "Type!=Success".

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...