Search for a field which is NOT success from multi-value field

chutz — Mon, 17 Aug 2020 04:29:38 GMT

Using `transaction` to trace email delivery through a chain of postfix relays, and I end up with a transaction where each relay reported a `status=`. In the normal case all of these are `status=sent` but now and then I see `status=bounced` or `status=deferred`.

How do I search for the non-success `status` when there are multiple success ones and only one non-success.

If I add `| search NOT status=sent` to the search, nothing gets matched because there is almost always a `status=sent`. Sadly, `| search status != sent` seems to behave the same way.

I could list all the other possible values so I can have `| search status=bounced OR status=deferred` but this not what I am looking for.

Re: Search for a field which is NOT success from multi-value field

to4kawa — Mon, 17 Aug 2020 04:57:54 GMT

| makeresults | eval status=split("success,bounced,deffered",",") | search status="bounced"

this works fine.

| makeresults | eval status=split("success,bounced,deffered",",") | search NOT status="bounced"

this doesn't work fine.

If NOT works well, there is not the words.

topic Re: Search for a field which is NOT success from multi-value field in Splunk Search

Search for a field which is NOT success from multi-value field

Re: Search for a field which is NOT success from multi-value field