topic Re: How to filter out a specific phrase in a Splunk search in Splunk Search

How to filter out a specific phrase in a Splunk search

frodelauka — Wed, 20 Mar 2024 12:32:08 GMT

I'm trying to search for a specific phrase with the search below but I only want result1, not result2. The issue here, I guess, is that parts of the phrase I'm searching for is present in both results (same phrase marked in bold) ->

Search:

index=example host=example message_name=* AND profileId="xxxx-xxxxx-xxxxx" AND "deviceClass":"example" AND "Message received: {"name":"screenView","screenName":"assetcard""

Result1:

MessageReceiver:96 - Message received: {"name":"screenView","screenName":"assetcard","previous":{"name":"screenView","screenName":"homeScreen","subscreenName":"STB.TOP.HOME"

Result2:

MessageReceiver:96 - Message received: {"name":"screenView","screenName":"homeScreen","previous":{"name":"screenView","screenName":"assetcard"

Re: How to filter out a specific phrase in a Splunk search

Gr0und_Z3r0 — Wed, 20 Mar 2024 13:02:28 GMT

Hi @frodelauka

One way to do it based on the events you shared is as below.

| makeresults | eval log="MessageReceiver:96 - Message received: {\"name\":\"screenView\",\"screenName\":\"assetcard\",\"previous\":{\"name\":\"screenView\",\"screenName\":\"homeScreen\",\"subscreenName\":\"STB.TOP.HOME\"\r\nMessageReceiver:96 - Message received: {\"name\":\"screenView\",\"screenName\":\"homeScreen\",\"previous\":{\"name\":\"screenView\",\"screenName\":\"assetcard\"" | makemv log delim="\r\n" | mvexpand log | eval check_msg_rxd=trim(replace(replace(mvindex(split(mvindex(split(log,",\"previous"),0),"received:"),-1),"\"",""),"\{","")) | where like(check_msg_rxd,"%assetcard")

If the reply helps, a Karma upvote would be appreciated.

Re: How to filter out a specific phrase in a Splunk search

frodelauka — Wed, 20 Mar 2024 13:27:17 GMT

I appreciate the feedback but as I'm just a Splunk rookie I do not understand the logic behind you query. Also, the makeresults function should be the first in the search so how would the entire search look like?

Re: How to filter out a specific phrase in a Splunk search

Gr0und_Z3r0 — Wed, 20 Mar 2024 16:47:23 GMT

Simplifying the way to approach it with a regex...

| rex field=_raw "Message received:\s\{(?P<check>.*?)\,\"previous" | where like(check,"%assetcard%")

The idea is to get values before the word "previous" and check that string with the one you want to meet your search criteria.

Re: How to filter out a specific phrase in a Splunk search

frodelauka — Wed, 20 Mar 2024 16:47:46 GMT

I understand. Still, trying to run the search it returns no result...

index=example host=* message_name=* AND profileId="example" AND "deviceClass":"example" AND "Message received: {"name":"screenView","screenName":"assetcard"" | rex field=_raw "Message received:\s\{(?P<check>.*?)\,\"previous" | where like(check,"%assetcard%")