topic Re: Removing a Pattern from the search result in Splunk Search

Removing a Pattern from the search result

jaiarchi — Tue, 29 Sep 2020 14:38:36 GMT

I am searching for a string "xyz" that would result in all actionsteps (with counts) that has "xyz" in it, However I want to remove any string that ends with xyz_I or xyz_S.

Would someone be able to help me on this please.

Re: Removing a Pattern from the search result

inventsekar — Fri, 23 Jun 2017 10:46:08 GMT

Hi Jaiarchi, some more details needed.. what is ur current search query, some sample log lines..

maybe try this one -
Index=indexName xyz NOT (xyz_I OR xyz_S)

Re: Removing a Pattern from the search result

gcusello — Tue, 29 Sep 2020 14:38:39 GMT

HI jaiarchi,
If I correctly understood: do you want to have all events where there is the string xyz but not the ones where there are xyz_I or xyz_S?
if this is your requirement you have to insert in your search:

your_search "xyz" NOT ("xyz_I" OR "xyz_S") | ...

Bye.
Giuseppe

Re: Removing a Pattern from the search result

woodcock — Fri, 23 Jun 2017 14:09:32 GMT

Show us the sample events and indicate the ones to keep and the ones not to keep (calling out field names/values).