Splunk Search

Question on include/exclude events

Deepz2612
Explorer

In the logs I wanted to include events that has the string "uri=https://www.bikerace.com" and if it is not present I wanted to include events with string "BAD_REQUEST_EXCEPTION".
But at times the case is that both the strings are present and when I write a query condition with "OR" statement both gets selected.
But I wat either of it only..If the 1st string is present,only that event..If the first string is not present then i wanted to have the event with second string.

Kindly help me with it.

Thanks!

Tags (1)
0 Karma

DavidHourani
Super Champion

Hi @Deepz2612,

Would be great if you could share your search string but I'm supposing that you have both fields uri and request and your search looks like this :

index=yourindex uri="https://www.bikerace.com" OR request="BAD_REQUEST_EXCEPTION"

You will need to modify the logic to make it look like this :

  index=yourindex (uri="https://www.bikerace.com" AND NOT request="BAD_REQUEST_EXCEPTION") OR (request="BAD_REQUEST_EXCEPTION" AND NOT uri="https://www.bikerace.com")

Let me know if that helps.

Cheers,
David

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...