Splunk Search

Conditional search: How to use negative search in case command ?

mxh7777
Path Finder

Hi,

I got these datas

URI TXT Param
A My text and others param 1
A My text and others param 2
A My text  param 3
A My text param 4
B My text and others param 2
B My text param 3
C My text and others param 1
C My text param4

I'd like to extract the datas according these rules :

- If URI = A, extract TXT that not contains "others"

- Else extract all

to obtain these results

URI TXT Param
A My text  param 3
A My text param 4
B My text and others param 2
B My text param 3
C My text and others param 1
C My text param4

 

I don't know how to build my request.

I try to use "case" command like this but it return a logical error (Error in 'EvalCommand': The arguments to the 'like' function are invalid. ) :

...
|eval TXT=case(URI="A", NOT LIKE("%others%"), 1=1, "others")
...

How to use negative search in case command ?

 

Thanks

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The case function takes arguments in pairs.  The first half of the pair must be a boolean expression and the second half must be non-boolean.  It is this non-boolean value that is assigned to TXT.

The like function requires two aruments.  The first is a field name and the second is a SQL pattern to compare the field value against.  If the field value matches the pattern then the function returns true; otherwise, it returns false.

Perhaps you only need a where command to filter out the undesired events.

| where (URL!="A" OR (URL="A" AND NOT like(TXT, "%others%")))
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The case function takes arguments in pairs.  The first half of the pair must be a boolean expression and the second half must be non-boolean.  It is this non-boolean value that is assigned to TXT.

The like function requires two aruments.  The first is a field name and the second is a SQL pattern to compare the field value against.  If the field value matches the pattern then the function returns true; otherwise, it returns false.

Perhaps you only need a where command to filter out the undesired events.

| where (URL!="A" OR (URL="A" AND NOT like(TXT, "%others%")))
---
If this reply helps you, Karma would be appreciated.

mxh7777
Path Finder

Thanks

This better with "where"

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...