topic Re: Querying for values without a specific character? in Splunk Search

Querying for values without a specific character?

yepyepyayyooo — Fri, 12 Apr 2019 12:33:05 GMT

Attempting to create a query that will return all values that do not have a . (dot) in their file name, meaning no file extension. Does anyone know of a way of achieving this? Seems simple but I can't figure it out. The query is a combination of terms that do have file extensions so I can't use filename!=".".

Re: Querying for values without a specific character?

harshpatel — Fri, 12 Apr 2019 12:46:42 GMT

can you please give example list of filenames and tell us what you want to filter out?

Re: Querying for values without a specific character?

vnravikumar — Fri, 12 Apr 2019 13:13:05 GMT

Give a try

| makeresults 
| eval file="test.txt,test1,temp.csv,test3" 
| makemv delim="," file 
| mvexpand file 
| where isnull(mvindex(split(file,"."),1))

New: Try this filters only file name

| makeresults 
| eval file="test.txt,test1,temp.csv,test3" 
| makemv delim="," file 
| mvexpand file 
| rex field=file "(?P<filename>[^.]+)"

Re: Querying for values without a specific character?

yepyepyayyooo — Fri, 12 Apr 2019 13:13:11 GMT

They're unknown. Basically you have filename1.doc and filename1.txt. I'm looking to return all values that are filename1 (no file extension)

Re: Querying for values without a specific character?

harshpatel — Fri, 12 Apr 2019 13:18:54 GMT

so you want to remove file extensions and return only filenames?