Getting Data In

simple filter question: eliminate the successes to focus on other events

Techfrogger
Explorer

Every day I do a search that searches this:

I know how to filter for a specific event so, for example, I always run this:

source=wineventlog:* earliest_time=-24h

And every day I get about 25,000 hits, 24,000 of which are of this type:

source=wineventlog:* earliest_time=-24h "Type=Success"

I'd like to filter out the 24,000 successes and instead show me the 1,000 events that are not of "Type=Success" How can I do that?

Tags (3)
0 Karma

Ayn
Legend

I don't get what's with all double posting of questions lately. How is this different from http://splunk-base.splunk.com/answers/62964/how-to-filter-by-does-not-equal ?

emotz
Splunk Employee
Splunk Employee

This is an easy one
source=wineventlog:* earliest_time=-24h NOT "Type=Success"

0 Karma

Techfrogger
Explorer

I figured it would be easy but I was clueless. Thanks, emotz!

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...