topic Re: Search for a field not containing a specific pattern. in Splunk Search

Search for a field not containing a specific pattern.

tdismukes — Thu, 31 Jul 2014 20:34:12 GMT

I have two indexed fields, FieldX and FieldY. I want to search for all instances of FieldX that contain 'ABC' where FieldY does not contain '123'. I assume the format would start something like:

FieldX=ABC AND FieldY

but I don't know how to finish that. Would someone please help me out?

Re: Search for a field not containing a specific pattern.

Jeff_Lightly_Sp — Thu, 31 Jul 2014 20:37:14 GMT

How about:

Your_SourceType (FieldX=ABC AND FieldY!=123)

Re: Search for a field not containing a specific pattern.

somesoni2 — Thu, 31 Jul 2014 20:43:25 GMT

Try something like this

FieldX="*ABC*" NOT FieldY="*123*"

Re: Search for a field not containing a specific pattern.

Jeff_Lightly_Sp — Thu, 31 Jul 2014 20:50:01 GMT

Didn't see (or at least comprehend) the words 'contain'. That certainly could matter!

Re: Search for a field not containing a specific pattern.

tdismukes — Thu, 31 Jul 2014 20:51:34 GMT

That was exactly what I needed, thanks.

Re: Search for a field not containing a specific pattern.

Nayra_bakshi — Sat, 02 Jul 2022 09:44:34 GMT

what to refer to if want to search on the whole payload/Raw logs, not in a particular field?

Re: Search for a field not containing a specific pattern.

Nayra_bakshi — Sat, 02 Jul 2022 09:45:42 GMT

What to refer if on whole payload without any fields ?

Re: Search for a field not containing a specific pattern.

PickleRick — Sat, 02 Jul 2022 10:54:00 GMT

Firstly, let me point out that you're trying to resurrect an 8 year old thread. Next time, start a new one with your question - you'll get better chance of reply.

Back to your question - if you want to find all events which don't contain the string "abc" _anywhere_ within the raw event, simply search for

NOT *abc*

Having said that - it's not the best way to search. If you search for something containing wildcard at the beginning of the search term (either as a straight search or a negative search like in our case) splunk has to scan all raw events to verify whether the event matches. It cannot use internal indexes of words to find only a subset of events which matches the condition.

Therefore you should, whenever possible, search for fixed strings.

And remember that while indexing events splunk splits them into words on whitespaces and punctuators. So "abc" will match both "abc def" as well as "whatever.abc.ding-dong".

Wildcards are often overused in splunk search and they might incur huge performance penalty.