Splunk Search

How do you exclude two matching field values in a search?

johann2017
Explorer

Hello,

I want to make a very specific exclusion from my search. In my case, there are two different field names I am interested in excluding, but I only want to exclude the search result if they BOTH match a specific value. To be more clear:

If "threat_name=WindowsThreat" and "src_ip=192.168.1.0/24" then do not return the search result.
If "threat_name=WindowsThreat" and "src_ip=something other than 192.168.1.0/24" then yes return the search result.
0 Karma
1 Solution

eykrevooh
Explorer

| search NOT (threat_name="WindowsThreat" AND src_ip="192.168.1.0/24")
OR
| where threat_name!="WindowsThreat" AND src_ip="192.168.1.0/24"

Either of these will work to give you all results where threat_name is not "WindowsThreat" and src_ip is not explicitly "192.168.1.0/24". If you are wanting to exclude all src_ips that fall in the CIDR range 192.168.1.0/24. You will need to change the where to...

| where threat_name!="WindowsThreat" AND NOT cidrmatch("192.168.1.0/24", src_ip)

View solution in original post

0 Karma

eykrevooh
Explorer

| search NOT (threat_name="WindowsThreat" AND src_ip="192.168.1.0/24")
OR
| where threat_name!="WindowsThreat" AND src_ip="192.168.1.0/24"

Either of these will work to give you all results where threat_name is not "WindowsThreat" and src_ip is not explicitly "192.168.1.0/24". If you are wanting to exclude all src_ips that fall in the CIDR range 192.168.1.0/24. You will need to change the where to...

| where threat_name!="WindowsThreat" AND NOT cidrmatch("192.168.1.0/24", src_ip)

0 Karma

johann2017
Explorer

Thank you! This worked

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...