https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regular-expression-to-filter-out-field-values/m-p/254360#M76166 <P>You can try like this</P> <PRE><CODE>your base search | regex yourfield!="^note-\w{15}.*" </CODE></PRE> Tue, 30 Aug 2016 15:08:10 GMT somesoni2 2016-08-30T15:08:10Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regular-expression-to-filter-out-field-values/m-p/254358#M76164 <P>Hi</P> <P>I want to exclude the field values starting with "note-" and more than 15 characters after it. How can I write the regex for this.</P> <P>eg:</P> <P>device<BR /> note-acv234454dfgdfg<BR /> note-dfdffgfghffe4353456 </P> Tue, 30 Aug 2016 14:43:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regular-expression-to-filter-out-field-values/m-p/254358#M76164 kiran331 2016-08-30T14:43:40Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regular-expression-to-filter-out-field-values/m-p/254359#M76165 <P>Does it have to be in regex? You could extract all the fieldvalues and then filter out using <CODE>where</CODE> Like this</P> <PRE><CODE>... | rex (?&lt;device&gt;captureeverything&gt; | where NOT match(device, "note*") OR len(device)&lt;15 </CODE></PRE> Tue, 30 Aug 2016 14:47:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regular-expression-to-filter-out-field-values/m-p/254359#M76165 sundareshr 2016-08-30T14:47:14Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regular-expression-to-filter-out-field-values/m-p/254360#M76166 <P>You can try like this</P> <PRE><CODE>your base search | regex yourfield!="^note-\w{15}.*" </CODE></PRE> Tue, 30 Aug 2016 15:08:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regular-expression-to-filter-out-field-values/m-p/254360#M76166 somesoni2 2016-08-30T15:08:10Z