Splunk Search

Conditional search: How to use negative search in case command ?

mxh7777
Path Finder

Hi,

I got these datas

URI TXT Param
A My text and others param 1
A My text and others param 2
A My text  param 3
A My text param 4
B My text and others param 2
B My text param 3
C My text and others param 1
C My text param4

I'd like to extract the datas according these rules :

- If URI = A, extract TXT that not contains "others"

- Else extract all

to obtain these results

URI TXT Param
A My text  param 3
A My text param 4
B My text and others param 2
B My text param 3
C My text and others param 1
C My text param4

 

I don't know how to build my request.

I try to use "case" command like this but it return a logical error (Error in 'EvalCommand': The arguments to the 'like' function are invalid. ) :

...
|eval TXT=case(URI="A", NOT LIKE("%others%"), 1=1, "others")
...

How to use negative search in case command ?

 

Thanks

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The case function takes arguments in pairs.  The first half of the pair must be a boolean expression and the second half must be non-boolean.  It is this non-boolean value that is assigned to TXT.

The like function requires two aruments.  The first is a field name and the second is a SQL pattern to compare the field value against.  If the field value matches the pattern then the function returns true; otherwise, it returns false.

Perhaps you only need a where command to filter out the undesired events.

| where (URL!="A" OR (URL="A" AND NOT like(TXT, "%others%")))
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The case function takes arguments in pairs.  The first half of the pair must be a boolean expression and the second half must be non-boolean.  It is this non-boolean value that is assigned to TXT.

The like function requires two aruments.  The first is a field name and the second is a SQL pattern to compare the field value against.  If the field value matches the pattern then the function returns true; otherwise, it returns false.

Perhaps you only need a where command to filter out the undesired events.

| where (URL!="A" OR (URL="A" AND NOT like(TXT, "%others%")))
---
If this reply helps you, Karma would be appreciated.

mxh7777
Path Finder

Thanks

This better with "where"

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...