https://community.splunk.com/t5/Splunk-Search/Search-results-that-do-not-contain-a-word/m-p/15600#M1948 <P>I tried for an hour but couldn't find the answer. I need to search my syslogs from a specific host for entries that do not contain the word Interface my current search line is:</P> <PRE><CODE>sourcetype="cisco_syslog" host="10.10.10.10" </CODE></PRE> <P>I tried </P> <PRE><CODE>sourcetype="cisco_syslog" host="10.10.10.10" | regex _raw(=|!=) [\ )?Interface(\] </CODE></PRE> <P>but it doesn't work.</P> <P>I'm sure I'm close but I am terrible at regular expressions.</P> Wed, 16 Jun 2010 04:21:28 GMT mtxpert 2010-06-16T04:21:28Z https://community.splunk.com/t5/Splunk-Search/Search-results-that-do-not-contain-a-word/m-p/15600#M1948 <P>I tried for an hour but couldn't find the answer. I need to search my syslogs from a specific host for entries that do not contain the word Interface my current search line is:</P> <PRE><CODE>sourcetype="cisco_syslog" host="10.10.10.10" </CODE></PRE> <P>I tried </P> <PRE><CODE>sourcetype="cisco_syslog" host="10.10.10.10" | regex _raw(=|!=) [\ )?Interface(\] </CODE></PRE> <P>but it doesn't work.</P> <P>I'm sure I'm close but I am terrible at regular expressions.</P> Wed, 16 Jun 2010 04:21:28 GMT https://community.splunk.com/t5/Splunk-Search/Search-results-that-do-not-contain-a-word/m-p/15600#M1948 mtxpert 2010-06-16T04:21:28Z https://community.splunk.com/t5/Splunk-Search/Search-results-that-do-not-contain-a-word/m-p/15601#M1949 <PRE><CODE>sourcetype="cisco_syslog" host="10.10.10.10" NOT "interface" </CODE></PRE> <P><A href="http://www.splunk.com/base/Documentation/latest/User/StartSearching#Add_Boolean_expressions" rel="nofollow">http://www.splunk.com/base/Documentation/latest/User/StartSearching#Add_Boolean_expressions</A></P> Wed, 16 Jun 2010 04:23:04 GMT https://community.splunk.com/t5/Splunk-Search/Search-results-that-do-not-contain-a-word/m-p/15601#M1949 gkanapathy 2010-06-16T04:23:04Z