https://community.splunk.com/t5/Splunk-Search/How-to-use-quot-NOT-quot-condition-in-regular-expression/m-p/143930#M40024 <P>for example i have the string "update event from remote cache". i need to use NOT condition for this to capture ab events other than that.</P> Mon, 27 Jul 2015 04:29:30 GMT Madhan45 2015-07-27T04:29:30Z https://community.splunk.com/t5/Splunk-Search/How-to-use-quot-NOT-quot-condition-in-regular-expression/m-p/143930#M40024 <P>for example i have the string "update event from remote cache". i need to use NOT condition for this to capture ab events other than that.</P> Mon, 27 Jul 2015 04:29:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-quot-NOT-quot-condition-in-regular-expression/m-p/143930#M40024 Madhan45 2015-07-27T04:29:30Z https://community.splunk.com/t5/Splunk-Search/How-to-use-quot-NOT-quot-condition-in-regular-expression/m-p/143931#M40025 <P>Maybe <A href="http://stackoverflow.com/questions/977251/regular-expressions-and-negating-a-whole-character-group">this answer</A> on Stack Overflow is of interest to you.</P> <P>But maybe you could just eval a field which flags events with your given string and filter based on that eval'd field, such as</P> <PRE><CODE>your_search | eval check=if(match(field, "update\sevent\sfrom\sremote\scache","nope","ok") | where check="ok" </CODE></PRE> <P>PS: this assumes that your string in question is in a field named "field".</P> Mon, 27 Jul 2015 07:02:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-quot-NOT-quot-condition-in-regular-expression/m-p/143931#M40025 jeffland 2015-07-27T07:02:09Z https://community.splunk.com/t5/Splunk-Search/How-to-use-quot-NOT-quot-condition-in-regular-expression/m-p/143932#M40026 <P>Does this not work (you <EM>MUST</EM> use ALL-CAPS for <CODE>NOT</CODE>)?</P> <PRE><CODE>NOT "event from remote cache" </CODE></PRE> Mon, 27 Jul 2015 14:53:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-quot-NOT-quot-condition-in-regular-expression/m-p/143932#M40026 woodcock 2015-07-27T14:53:56Z https://community.splunk.com/t5/Splunk-Search/How-to-use-quot-NOT-quot-condition-in-regular-expression/m-p/143933#M40027 <P>You might want to look at rex Non-capturing which may do what you want with some rex trickery, but with out some samples its tough to tell. <A href="http://www.regular-expressions.info/refcapture.html">http://www.regular-expressions.info/refcapture.html</A></P> Mon, 27 Jul 2015 17:23:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-quot-NOT-quot-condition-in-regular-expression/m-p/143933#M40027 bmacias84 2015-07-27T17:23:35Z