Getting Data In

How to use the where clause and wildcard to filter results?

shiftey
Path Finder

Hi,

I am trying to run this search without success (the search runs however there are 0 results)

sourcetype=dhcplogs description=assign | replace ABC* with ABC in dest  | where dest!=ABC

Computers have hostnames in the format "ABC12345678". dest is the field that contains the hostname. I want to exclude these hosts (and other hosts) from the search results.

Any suggestions?

Cheers

Tags (3)
0 Karma
1 Solution

MuS
Legend

Hi shiftey,

try something like this:

sourcetype=dhcplogs description=assign | replace ABC* with ABC in dest | where dest!="ABC"

The reason for this is, that where compares the value of two fields or does evaluate boolean expressions. Whereas search can do a wildcard filter like search foo!=bo*.

Hope this helps ...

cheers, MuS

View solution in original post

MuS
Legend

Hi shiftey,

try something like this:

sourcetype=dhcplogs description=assign | replace ABC* with ABC in dest | where dest!="ABC"

The reason for this is, that where compares the value of two fields or does evaluate boolean expressions. Whereas search can do a wildcard filter like search foo!=bo*.

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...