topic Re: Not Like function !Like in Splunk Search

Not Like function !Like

navdeep1568 — Thu, 13 Feb 2020 21:35:10 GMT

I am trying to search for a server which is named differently than all the others in our network. Commonly servers are named with Location followed by 4 digits and then some string in the end (Eg: Flra2209php_ua).

If one of the machines is not following this naming convention, how do I search for it? I was hoping there would be a "not like" function which might help with this?

Re: Not Like function !Like

richgalloway — Fri, 14 Feb 2020 01:05:16 GMT

Try regex. Use | regex Name!="\w{4]\d{4}.*" to exclude events where the "Name" field doesn't contain four alphanumerics, then four digits, and then any text.

Re: Not Like function !Like

vnravikumar — Fri, 14 Feb 2020 03:20:20 GMT

Hi @navdeep1568

Try this

| makeresults 
| eval server="Flra2209php_ua,Flra2209" 
| makemv delim="," server 
| mvexpand server 
| where NOT match(server,"\w+\d{4}\S+")