Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Back ground exclusion

$
0
0

So I have search and I would like to exclude all of those results from some future searches. Aside from specifying some by NOT, which given the length of the first search would be questionable at best. Is there a way to make this exclusion in the backgrounmd not in search?

Here is the search:

search terms  | eval TimeInHour=_time%3600 
| rex mode=sed "s/ \d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{1,2}:\d{1,2}//g" 
| stats first(_raw) by punct,TimeInHour,_raw,_time 
|  stats count by _raw,TimeInHour,punct 
|  addinfo| eval hours = round((info_max_time - info_min_time)/3600,0) 
| where count > hours-1

Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>