topic How to search for events that do not contain a field, where that field has a period in its name? in Splunk Search

How to search for events that do not contain a field, where that field has a period in its name?

mdufrasne — Wed, 20 Jul 2016 00:10:04 GMT

I have JSON records.
Some contain the field logdata.message, others contain the field logdata.exception.Message.
I wish to find all the records where logdata.exception.Message does not exist.

Note that both logdata and logdata.exception are parsed as objects containing fields (strings) or other objects.

I tried the approach suggested here (https://answers.splunk.com/answers/59305/how-to-find-records-that-do-not-contain-a-certain-field.html) but the following didn't work:

index=appdata level="ERROR" NOT 'logdata.exception'=* NOT 'logdata.exception.Message'=*

Since the fields have periods in their qualified names, I wrapped them in single quotes.

Re: How to search for events that do not contain a field, where that field has a period in its name?

sundareshr — Wed, 20 Jul 2016 01:10:25 GMT

Try this

index=appdata level="ERROR" NOT ('logdata.exception'=* OR 'logdata.exception.Message'=*)

Re: How to search for events that do not contain a field, where that field has a period in its name?

mdufrasne — Wed, 20 Jul 2016 01:21:27 GMT

no go - I replaced the OR with AND as well. Neither worked. 😞

Re: How to search for events that do not contain a field, where that field has a period in its name?

sundareshr — Wed, 20 Jul 2016 01:32:23 GMT

Does index=appdata level="ERROR" return valid data?

Re: How to search for events that do not contain a field, where that field has a period in its name?

gcusello — Wed, 20 Jul 2016 06:37:37 GMT

Why,if you need events "where logdata.exception.Message does not exist", you used both the conditions?
Bye.
Giuseppe

Re: How to search for events that do not contain a field, where that field has a period in its name?

woodcock — Wed, 20 Jul 2016 13:30:39 GMT

You must use double-quotes, not single-quotes. Try this:

index=appdata level="ERROR" NOT ("logdata.exception"="*" OR "logdata.exception.Message"="*")