topic Re: How to search for events that doesn't contain "-" in the url request in Splunk Search

How to search for events that doesn't contain "-" in the url request

jkirankumar1993 — Wed, 28 Feb 2018 22:55:55 GMT

Hi i want to retrieve events that does not have "-" in the request url.

index=con_jira [| gentimes start=-1 | eval source="/opt/atlassian/current/logs/access_log." + strftime(now(), "%F")  | return source] "GET /browse" | eval headers=split(_raw," ") | eval method=mvindex(headers,5) |eval request=mvindex(headers,6) | where request!="*-" | table request

sample Result:
/browse/EPS -----> correct result
/browse/ISPTEXAS-27534 ----> wrong result

Re: How to search for events that doesn't contain "-" in the url request

worshamn — Thu, 01 Mar 2018 00:31:13 GMT

Probably several ways to skin this cat. You could try modifying where clause to:

|where NOT request LIKE "%-%"

Or just use search:

|search NOT request="*-*"

Or use the regex command:

|regex request!=".*-.*"

Re: How to search for events that doesn't contain "-" in the url request

mayurr98 — Thu, 01 Mar 2018 06:44:57 GMT

hey try this run anywhere search

| makeresults 
| eval request="/browse/EPS /browse/ISPTEXAS-27534 /browse/fsfsf-27534 /browse/abc /browse/edg /browse/abc-def" 
| makemv request 
| mvexpand request 
| where NOT like(request,"%-%")

In your environment, you should write

index=con_jira 
    [| gentimes start=-1 
    | eval source="/opt/atlassian/current/logs/access_log." + strftime(now(), "%F") 
    | return source] "GET /browse" 
| eval headers=split(_raw," ") 
| eval method=mvindex(headers,5) 
| eval request=mvindex(headers,6) 
| table request 
| where NOT like(request,"%-%")

let me know if this helps!