https://community.splunk.com/t5/Splunk-Dev/Skip-message-starting-with-Integer-in-Splunk/m-p/397786#M6791 <P>Give this a try,</P> <P><CODE>eventtype=logs | where match(message, "\D") | stats count as Total by message | rename message AS "Type"</CODE></P> Thu, 09 Aug 2018 17:47:39 GMT sudosplunk 2018-08-09T17:47:39Z https://community.splunk.com/t5/Splunk-Dev/Skip-message-starting-with-Integer-in-Splunk/m-p/397785#M6790 <P>I am creating a query to get message type count but i want to skip some the message that are not valid . Some of the messages are starting like "-100" or "Data ...". I want to skip them while i counting the messages count.</P> <P>TO get the count i am using below query :</P> <PRE><CODE>eventtype=logs | stats count as Total by message | rename message AS "Type" </CODE></PRE> <P>Message field has below data :</P> <P>Data nprops 5 1<BR /> Data props 0<BR /> -102<BR /> 1432<BR /> sql error</P> <P>I want to skip all message which are starting from positive ,negative number and those as well which start from Data. </P> Thu, 09 Aug 2018 17:35:21 GMT https://community.splunk.com/t5/Splunk-Dev/Skip-message-starting-with-Integer-in-Splunk/m-p/397785#M6790 gauravepi 2018-08-09T17:35:21Z https://community.splunk.com/t5/Splunk-Dev/Skip-message-starting-with-Integer-in-Splunk/m-p/397786#M6791 <P>Give this a try,</P> <P><CODE>eventtype=logs | where match(message, "\D") | stats count as Total by message | rename message AS "Type"</CODE></P> Thu, 09 Aug 2018 17:47:39 GMT https://community.splunk.com/t5/Splunk-Dev/Skip-message-starting-with-Integer-in-Splunk/m-p/397786#M6791 sudosplunk 2018-08-09T17:47:39Z