Getting Data In

How to use the where clause and wildcard to filter results?

shiftey
Path Finder

Hi,

I am trying to run this search without success (the search runs however there are 0 results)

sourcetype=dhcplogs description=assign | replace ABC* with ABC in dest  | where dest!=ABC

Computers have hostnames in the format "ABC12345678". dest is the field that contains the hostname. I want to exclude these hosts (and other hosts) from the search results.

Any suggestions?

Cheers

Tags (3)
0 Karma
1 Solution

MuS
Legend

Hi shiftey,

try something like this:

sourcetype=dhcplogs description=assign | replace ABC* with ABC in dest | where dest!="ABC"

The reason for this is, that where compares the value of two fields or does evaluate boolean expressions. Whereas search can do a wildcard filter like search foo!=bo*.

Hope this helps ...

cheers, MuS

View solution in original post

MuS
Legend

Hi shiftey,

try something like this:

sourcetype=dhcplogs description=assign | replace ABC* with ABC in dest | where dest!="ABC"

The reason for this is, that where compares the value of two fields or does evaluate boolean expressions. Whereas search can do a wildcard filter like search foo!=bo*.

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...