Problem:
How to filter out specific sources, sourcetypes, and hosts from displaying on my Search Summary page in Splunk?
Sample Data – https://www.devopsschool.com/tutorial/splunk/labs/sample-data/earthquake/all_month_earthquakes.csv
Including or excluding or filter out specific sources, sourcetypes, and hosts in Splunk can be done with following.
- Expressions within parentheses
- NOT clauses
- OR clauses
- AND clauses
Examle QUERY
source="*"
source="all_month_earthquakes.csv"
source="all_month_earthquakes.csv" NOT source="mypc-secruity.csv"
source="mypc-secruity.csv" NOT source="all_month_earthquakes.csv"
NOT source="mypc-secruity.csv" source="all_month_earthquakes.csv"
source="all_month_earthquakes.csv" | search NOT source="mypc-secruity.csv"
source="mypc-secruity.csv" AND source="all_month_earthquakes.csv"
source="mypc-secruity.csv" OR source="all_month_earthquakes.csv"
Splunk Advance Tutorial for Beginners with Demo 2020 — By DevOpsSchool
Splunk Advance Tutorial for Beginners with Demo (2020) — By DevOpsSchool
Splunk Advance Tutorial for Beginners with Demo [2020] — By DevOpsSchool
SPLUNK Essential Tutorial By Shahrukh in 2020
Latest posts by Rajesh Kumar (see all)
- Implementing Managed IT Services: A Step-by-Step Guide - August 30, 2024
- DevOps Foundation Certification - August 29, 2024
- SRE Foundation Certification - August 29, 2024