topic Re: Exclude regex results from a search in Splunk Search

Exclude regex results from a search

gnoellbn — Fri, 02 Aug 2013 16:57:57 GMT

Hello,

I'm trying to run the following search in order to list all the failed connection.

In our parc we have computers that start with Q and immediately followed by a number. So I know the following search (without the NOT) shows only these computers.

source="WinEventLog:Security" "CategoryString=Ouverture/fermeture" "Type=Failure" Type="Failure Audit" NOT regex host="Q[0-9].*" | stats count by host

But when I add the NOT it doesn't display anything what am I doing wrong ?

Thanks,
Gaetan

Re: Exclude regex results from a search

jtrucks — Fri, 02 Aug 2013 17:06:21 GMT

Do this instead:

source="WinEventLog:Security" "CategoryString=Ouverture/fermeture" "Type=Failure" Type="Failure Audit" | regex host!="Q[0-9].*" | stats count by host

Because regex is a command and the way you have it is: NOT regex AND host="![0-9]"

Re: Exclude regex results from a search

gnoellbn — Fri, 02 Aug 2013 18:04:06 GMT

Works like a charm! Thanks a lot