topic Re: Splunk query help - query for URL that have values other than X,Y,Z in Splunk Search

Splunk query help - query for URL that have values other than X,Y,Z

Splunkanator — Sat, 27 Jan 2024 02:14:16 GMT

Lets say i would like to query for message that has a URL field with values other than X,Y,Z added as query parameters , how do i go about this ?

TIA

kamlesh_vaghela — Sat, 27 Jan 2024 06:55:23 GMT

Can you please share some sample events and expected output?

tscroggins — Sun, 28 Jan 2024 01:13:15 GMT

If your events have an extracted uri_query field, which is typical for e.g. NCSA and W3C log formats, you can use != or NOT to exclude events:

index=main sourcetype=access_common uri_query!=*param=X* uri_query!=*param=Y* uri_query!=*param=Z*

index=main sourcetype=access_common NOT uri_query IN (*param=X* *param=Y* *param=Z*)

However, those will exclude events with partially matching names or values.

Performance will vary, but you can use the regex command to match events with fields that do no match a regular expression:

index=main sourcetype=access_common
| regex uri_query!="(^|&)param=(X|Y|Z)(&|$)"