Splunk Search

Conditional search: How to use negative search in case command ?

mxh7777
Path Finder

Hi,

I got these datas

URI TXT Param
A My text and others param 1
A My text and others param 2
A My text  param 3
A My text param 4
B My text and others param 2
B My text param 3
C My text and others param 1
C My text param4

I'd like to extract the datas according these rules :

- If URI = A, extract TXT that not contains "others"

- Else extract all

to obtain these results

URI TXT Param
A My text  param 3
A My text param 4
B My text and others param 2
B My text param 3
C My text and others param 1
C My text param4

 

I don't know how to build my request.

I try to use "case" command like this but it return a logical error (Error in 'EvalCommand': The arguments to the 'like' function are invalid. ) :

...
|eval TXT=case(URI="A", NOT LIKE("%others%"), 1=1, "others")
...

How to use negative search in case command ?

 

Thanks

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The case function takes arguments in pairs.  The first half of the pair must be a boolean expression and the second half must be non-boolean.  It is this non-boolean value that is assigned to TXT.

The like function requires two aruments.  The first is a field name and the second is a SQL pattern to compare the field value against.  If the field value matches the pattern then the function returns true; otherwise, it returns false.

Perhaps you only need a where command to filter out the undesired events.

| where (URL!="A" OR (URL="A" AND NOT like(TXT, "%others%")))
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The case function takes arguments in pairs.  The first half of the pair must be a boolean expression and the second half must be non-boolean.  It is this non-boolean value that is assigned to TXT.

The like function requires two aruments.  The first is a field name and the second is a SQL pattern to compare the field value against.  If the field value matches the pattern then the function returns true; otherwise, it returns false.

Perhaps you only need a where command to filter out the undesired events.

| where (URL!="A" OR (URL="A" AND NOT like(TXT, "%others%")))
---
If this reply helps you, Karma would be appreciated.

mxh7777
Path Finder

Thanks

This better with "where"

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...