topic search correction with NOT in Splunk Search

search correction with NOT

aniketb — Wed, 18 Sep 2013 18:14:44 GMT

I have an alert setup. It is like

"ABC-* NOT ("ABC-1" OR "ABC-2")

"ABC-1", "ABC-2" being stuff I have taken care of.

My result is like:

ABC-
ABC-3
ABC-4
ABC-5

I want to remove that "ABC-".

The problem is, if I add it as NOT to the search, I see no results. Like in

"ABC-* NOT ("ABC-" OR "ABC-1" OR "ABC-2")

I get 0 results. How to do that correctly?

Re: search correction with NOT

yannK — Wed, 18 Sep 2013 18:18:51 GMT

The ABC-* is very generic.

if you have a space after ABC-
"ABC-* NOT ("ABC-1" OR "ABC-2" OR "ABC- ")

otherwise, you can add a second regex filter after to keep only ABC-

"ABC-* NOT ("ABC-1" OR "ABC-2") | regex _raw="ABC-\d"

Re: search correction with NOT

aniketb — Wed, 18 Sep 2013 18:40:57 GMT

I do pass this to a regex because this is an error code. Your regex doesn't gel well with mine. My complete search string is

"ABC-" NOT ("ABC-1" OR "ABC-2") | rex "(?ABC-[0-9])" | stats count by ErrorName | sort-count

Also there's no space after "ABC-"

Re: search correction with NOT

yannK — Wed, 18 Sep 2013 20:10:20 GMT

It works, the events with a non matching rex field "errorname" will have a null value for errorname, and should not appear in your stats by errorname.

Re: search correction with NOT

lguinn2 — Thu, 19 Sep 2013 00:05:32 GMT

Try this

"abc-* NOT ("abc-1" OR "abc-2" OR TERM("abc-"))

You can read more about TERM here

Re: search correction with NOT

lukejadamec — Thu, 19 Sep 2013 01:06:30 GMT

Thanks for the new term... er tool.
Why not just use
regex _raw="ABC-\d"
as the search and then NOT whateverelse?

Re: search correction with NOT

lguinn2 — Fri, 20 Sep 2013 05:50:20 GMT

You can't use regex as the search, although you could run a search and then apply the regex command to it as @yannK did...