Wildcard with Notequal condition

renuka — Thu, 10 Dec 2020 16:49:48 GMT

Hello

I am trying to extract count of the data by excluding some values which are not equal and some are equal in particular filed

My query

index=platform source=`ProjectArea` |join type=inner ProjectAreaID max=0 [search index=`platform` source=`RequirementModules` |fillnull value="Not Defined"|search Owner!="Tool" |join type=inner ModuleID max=0 [search index=`platform` source=`SoftwareRequirements` `ReqID_URL_Rename`|rename Owner as ReqOwner ]]|search `Software_ModuleType` `SoftwareRequirementType` |fillnull value="Not Defined"|dedup LinkStart_URL|search ModuleID="*" Status="*" Owner="*" | join type=inner LinkStart_URL max=0 [search index=`platform` source=Sw_Satisfaction`|rename LinkEnd_URL as SysURL]|join type=inner SysURL max=0 [search index=`platform` source=`SystemRequirements` `ReqID_URL_Rename` |rename LinkStart_URL as SysURL] |search ModuleName!="A*" AND ModuleName="*_ext" |stats count by ModuleName

Output comes zero when i give (ModuleName!="A*" AND ModuleName="*_ext") this condition

My output contains A* values,V* and A*_ext i want to exculde only A* values

Please help with this

Thank You in advance

Renuka

Re: Wildcard with Notequal condition

ITWhisperer — Thu, 10 Dec 2020 18:55:47 GMT

Instead of search, can you use regex?

| regex ModuleName="^[^A].*_ext$"

Re: Wildcard with Notequal condition

renuka — Fri, 11 Dec 2020 04:37:36 GMT

Thanks for reply I will try @ITWhisperer

topic Wildcard with Notequal condition in Splunk Dev

Wildcard with Notequal condition

Re: Wildcard with Notequal condition

Re: Wildcard with Notequal condition