Splunk Search

Exclude any transaction that doesn't include a specific value

marxsabandana
Path Finder

I need to filter searches that has a value of "F*" included per transaction number. The transaction number with my search will be composed of multiple product codes. Along with the values starting with "F".

A field name called "ProductCode" has values like: "F1, SH, VE, BB4521036, BB7895411"

| stats list(ProductCode) as ProductdCode by TransactionNumber

So, one event would look like this:

TransactionNumber | ProductCode

000532154 | F1
---------------- SH
---------------- VE
---------------- BB4521036
---------------- BB7895411

065212737 | CT
---------------- 12
---------------- SD
---------------- BB1125364
---------------- BB7885621

044568931 | F6
---------------- 08
---------------- JO
---------------- BB1125364
---------------- BB7885621

I only want to include transactions that includes ProductCodes starting with "F" while keeping the other ProductCodes intact. Thus, the 2nd event not having any product code starting with "F", should be excluded.

0 Karma

Sukisen1981
Champion
|eval first_val=mvindex(ProductCode,0)| where !LIKE(first_val, "F%")

Couple of points to keep in mind
list only returns the first 100 values , and more than that are you sure F ALWAYS occurs in the first row of the multivalued field?
For instance, can F6 occur after 08 OR JO in the ProductCode multivalued field?

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...