Exclude any transaction that doesn't include a specific value

marxsabandana — Thu, 09 May 2019 02:44:11 GMT

I need to filter searches that has a value of "F*" included per transaction number. The transaction number with my search will be composed of multiple product codes. Along with the values starting with "F".

A field name called "ProductCode" has values like: "F1, SH, VE, BB4521036, BB7895411"

| stats list(ProductCode) as ProductdCode by TransactionNumber

So, one event would look like this:

TransactionNumber | ProductCode

000532154 | F1
---------------- SH
---------------- VE
---------------- BB4521036
---------------- BB7895411

065212737 | CT
---------------- 12
---------------- SD
---------------- BB1125364
---------------- BB7885621

044568931 | F6
---------------- 08
---------------- JO
---------------- BB1125364
---------------- BB7885621

I only want to include transactions that includes ProductCodes starting with "F" while keeping the other ProductCodes intact. Thus, the 2nd event not having any product code starting with "F", should be excluded.

Re: Exclude any transaction that doesn't include a specific value

Sukisen1981 — Sat, 11 May 2019 11:01:13 GMT

|eval first_val=mvindex(ProductCode,0)| where !LIKE(first_val, "F%")

Couple of points to keep in mind
list only returns the first 100 values , and more than that are you sure F ALWAYS occurs in the first row of the multivalued field?
For instance, can F6 occur after 08 OR JO in the ProductCode multivalued field?

topic Re: Exclude any transaction that doesn't include a specific value in Splunk Search

Exclude any transaction that doesn't include a specific value

Re: Exclude any transaction that doesn't include a specific value