Getting Data In

Excluding log entries based on specific String in msg field

bblackmon
New Member

Hi,

I have a problem excluding or including only entries that contain specific String values in the msg field. For example, there are two (maybe more) definite String values contained in the msg field:

1. "GET /ecc/v1/content/preLoginBanners HTTP/1.0"

2. "GET /ecc/v1/content/category/LegalTerms HTTP/1.0"

I need 3 statements like the following:

1. Include ONLY 1 above in the msg field.

2. Include ONLY 2 above in the msg field.

3. Exclude 1 and 2 above to determine if there are more unknown values in the msg field. 

I imagine I will be using thistype of  logic more on other output fields as time goes on.

I am new to this and I am using the XML-based AdHoc Search input/output form. Any help is greatly appreciated!

 

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

OK. You're mixing so many different things here that I'm not really sure what you want.

You posted this in "Getting Data In" section which typically deals with issues regarding ingesting data from sources into Splunk.

You labeled your post with "field extraction" but doesn't mention the extraction in the contents - are your fields properly extracted? Do you need to extract them before searching?

And your post is clearly about searching as such. But mentions something you call "XML-based AdHoc Search input/output form". What do you mean?

I suggest you check out the "Intro to Splunk" free course on the STEP education portal (see https://www.splunk.com/en_us/training/course-catalog.html )

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...