topic Re: Return events with excluded field value combined with all events that have no value for that field in Splunk Search

How can I return events with excluded field value combined with all events that have no value for that field?

foxglove — Thu, 11 May 2023 02:04:53 GMT

Hello all.

I've been having some trouble with a tricky query. Essentially, I want to return all events that contain a certain field, with a specific value excluded, and combine that with all events that also contain nothing for that particular field.

For excluding the field value, I would use:

... field!=value

And for all events that do not have a value for that field, I would use:

... NOT field="*"

I have no idea how to combine these, as one requires the field and the other completely excludes it. I have tried:

<search> field!=value | fields -field

But it doesn't work, as I believe I'm basically applying a filter but doing nothing with it.

Any help will be greatly appreciated! Thank you.

Re: Return events with excluded field value combined with all events that have no value for that field

bowesmana — Wed, 10 May 2023 22:25:18 GMT

So you want this?

search .... (field!=value OR NOT field=*)

Re: Return events with excluded field value combined with all events that have no value for that field

2ero — Thu, 11 May 2023 00:27:33 GMT

I believe what you're looking to do should be implicitly solved by searching

NOT field=value

When searching with != you are also telling Splunk to only return results with a valid entry for that field. Take a look at the documentation for Difference between != and NOT for an in-depth breakdown of the differences.

But @foxglove your question is a bit ambiguous, are you searching against two separate fields, looking for both null/nonexistent value and non-excluded values, or only null/nonexistent values that also don't match the searched value?

Re: Return events with excluded field value combined with all events that have no value for that field

foxglove — Thu, 11 May 2023 12:50:01 GMT

Apologies for the ambiguity. I did mean the same field. Your solution is what I was looking for, so thank you. I forgot about the implicit nature of NOT in that it excludes all events that have a particular value for that field, which would include all events that do not any value for that field at all. Thanks again!