Splunk Search

Excluding one user name from search

robK123
Explorer

I have this search:

(index=infrastructure-os OR index=main) sudo "incorrect password attempt*" |rex field=_raw "sudo:[^a-z]+(?[^ ]+) : (?[0-9]+) incorrect"|stats sum(failures) by user, host

But I am unsure how to exclude one user called addmm from the results as I do not want to see that one.

Thanks,

Tags (1)
0 Karma

jangid
Builder

try
NOT user="addmm"

0 Karma

robK123
Explorer

That worked perfectly thank you!

0 Karma

jonuwz
Influencer

There's 2 ways to filter out the user.
append either :

| search NOT user="addm"

or

| where user!="addm"

robK123
Explorer

I tried:

(index=infrastructure-os OR index=main) sudo "incorrect password attempt*" |rex field=_raw "sudo:[^a-z]+(?[^ ]+) : (?[0-9]+) incorrect"|stats sum(failures) by user, host NOT user="addm"

but get the following error when I try:

Error in 'stats' command: The argument 'user=addm' is invalid.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...