topic Re: How to filter out the event log based on the Message attribute which is having space in Splunk Search

How to filter out the event log based on the Message attribute which is having space

nsudha1975 — Wed, 30 Sep 2020 05:13:46 GMT

Here is my event log sample below
[LOG LEVEL=INFO] [LOGGER=WIFI_ACCESS_INFO] [INTERFACE ID=WIFI_ACCESS] [STEP=START] [RUN_ID=20200426140325679] [Message=Call received for PID: 1234 ]

Actually i don't need this event, so I would like filter out this event based on the Message but it is not working as Message has phrase. Please let me know how to filter out this event. Thanks for your help in advance.

Re: How to filter out the event log based on the Message attribute which is having space

PavelP — Mon, 27 Apr 2020 06:04:54 GMT

Hello @nsudha1975,

there are several options, two of them are:

  | regex _raw!="\[Message=Call received for PID"

and

  NOT "Message=Call received for PID"

if you want to extract the field Message in full try this:

  | rex "\[Message=(?<Message>[^\]]+)\]"

Let me know how it went