Splunk Search
Highlighted

Can you help me with a search which only shows results that do not contain a specific value?

Contributor

I want to see devices that do not have a specific value. I am organizing my devices by Mac Address, and I am trying to see the ones that do not have a profile named WifiProfile_X.

I keep getting the ones that do contain this profile, but I need to see the ones that dont.. any ideas?

index=nitro_apps source="DATA" | rex "^[^,\n]*,(?P<OG>[^,]+)[^,\n]*,(?P<MacAddress>[^,]+)(?:[^ \n]* ){4}(?P<Model>[^,]+),(?P<OS>[^,]+),\w+,(?P<Profile>[^,]+),\d+,(?P<Latest_Version>\d+),(?P<Installed_Date>[^,]+)[^,\n]*,(?P<Installed>\w+)"  | search OG=7 AND Model=180 AND Profile NOT "WifiProfile_X"
|stats list(MacAddress), list(Model), dc(MacAddress)
0 Karma
Highlighted

Re: Can you help me with a search which only shows results that do not contain a specific value?

Influencer

Hi,

Try using this search-

search OG=7 AND Model=180 AND Profile != "WifiProfile_X"

Thanks

0 Karma
Highlighted

Re: Can you help me with a search which only shows results that do not contain a specific value?

Contributor

Unfortunately no, this gives me every device in that location regardless of each devices settings.

0 Karma
Highlighted

Re: Can you help me with a search which only shows results that do not contain a specific value?

Influencer

Do you want to list count of all distinct Mac address and also list all models and MacAddress by Profile? What does device settings refer to?

0 Karma
Highlighted

Re: Can you help me with a search which only shows results that do not contain a specific value?

Contributor

It was my regex... figured it out, thanks!

0 Karma
Highlighted

Re: Can you help me with a search which only shows results that do not contain a specific value?

@joshuajohn

i'm glad you figured out the problem for yourself. Would you mind describing how you were able to fix your regex so that future users could learn from your process? Thanks.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.