... | regex <field>!="<regex>"
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Regex
Let me guess, you want to do a regex on _raw
, but you don't want the regex to search one of the fields?
... | regex <field>!="<regex>"
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Regex
Doesn't that mean "field value not equal regex" ?
you want to exclude some fields from your output?