Getting Data In

Excluding log entries based on specific String in msg field

New Member


I have a problem excluding or including only entries that contain specific String values in the msg field. For example, there are two (maybe more) definite String values contained in the msg field:

1. "GET /ecc/v1/content/preLoginBanners HTTP/1.0"

2. "GET /ecc/v1/content/category/LegalTerms HTTP/1.0"

I need 3 statements like the following:

1. Include ONLY 1 above in the msg field.

2. Include ONLY 2 above in the msg field.

3. Exclude 1 and 2 above to determine if there are more unknown values in the msg field. 

I imagine I will be using thistype of  logic more on other output fields as time goes on.

I am new to this and I am using the XML-based AdHoc Search input/output form. Any help is greatly appreciated!


Labels (1)
0 Karma


OK. You're mixing so many different things here that I'm not really sure what you want.

You posted this in "Getting Data In" section which typically deals with issues regarding ingesting data from sources into Splunk.

You labeled your post with "field extraction" but doesn't mention the extraction in the contents - are your fields properly extracted? Do you need to extract them before searching?

And your post is clearly about searching as such. But mentions something you call "XML-based AdHoc Search input/output form". What do you mean?

I suggest you check out the "Intro to Splunk" free course on the STEP education portal (see )

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...