Getting Data In

How can I filter my search for a field only if the result is not a number?

bradmeg128
Engager

I am trying to filter my search for a field only if the result is not a number

EG
Index=proxylogs where isnum(cs_user) - This gives me the results only if the cs_user field is a number, i want the opposite; to show me only the ones that are NOT a number

I have tried isStr but that still gives me the numerical answers as well. I have tried various combinations of NOT's but cannot seem to get it to display only the non-numericals.

Any help is greatly appreciated

V/r
-Brad

0 Karma
1 Solution

javiergn
Super Champion

For completion I would use the following perhaps:

index=proxylogs
| regex cs_user="\D+"

Where the regular expression \D refers to any non-numerical character and the plus means one or more occurrences.

Thanks,
J

niketn
Legend

Try the following:

 <YourBaseSearch>
| where !(isnum(cs_user))
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

somesoni2
Revered Legend

So, you're saying this didn't work?

index=proxylog | where NOT isnum(cs_user)

Give this a try as well.

index=proxylog | regex cs_user!="^[\d\.,]+$"

woodcock
Esteemed Legend

You should be aware that all of these answers are throwing away events where field cs_user has no value at all (e.g. isnull(cw_user) ) which you might care about, or might not.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...