Splunk Search

Conditional search: How to use negative search in case command ?

mxh7777
Path Finder

Hi,

I got these datas

URI TXT Param
A My text and others param 1
A My text and others param 2
A My text  param 3
A My text param 4
B My text and others param 2
B My text param 3
C My text and others param 1
C My text param4

I'd like to extract the datas according these rules :

- If URI = A, extract TXT that not contains "others"

- Else extract all

to obtain these results

URI TXT Param
A My text  param 3
A My text param 4
B My text and others param 2
B My text param 3
C My text and others param 1
C My text param4

 

I don't know how to build my request.

I try to use "case" command like this but it return a logical error (Error in 'EvalCommand': The arguments to the 'like' function are invalid. ) :

...
|eval TXT=case(URI="A", NOT LIKE("%others%"), 1=1, "others")
...

How to use negative search in case command ?

 

Thanks

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The case function takes arguments in pairs.  The first half of the pair must be a boolean expression and the second half must be non-boolean.  It is this non-boolean value that is assigned to TXT.

The like function requires two aruments.  The first is a field name and the second is a SQL pattern to compare the field value against.  If the field value matches the pattern then the function returns true; otherwise, it returns false.

Perhaps you only need a where command to filter out the undesired events.

| where (URL!="A" OR (URL="A" AND NOT like(TXT, "%others%")))
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The case function takes arguments in pairs.  The first half of the pair must be a boolean expression and the second half must be non-boolean.  It is this non-boolean value that is assigned to TXT.

The like function requires two aruments.  The first is a field name and the second is a SQL pattern to compare the field value against.  If the field value matches the pattern then the function returns true; otherwise, it returns false.

Perhaps you only need a where command to filter out the undesired events.

| where (URL!="A" OR (URL="A" AND NOT like(TXT, "%others%")))
---
If this reply helps you, Karma would be appreciated.

mxh7777
Path Finder

Thanks

This better with "where"

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...