Splunk Search

Exclude any transaction that doesn't include a specific value


I need to filter searches that has a value of "F*" included per transaction number. The transaction number with my search will be composed of multiple product codes. Along with the values starting with "F".

A field name called "ProductCode" has values like: "F1, SH, VE, BB4521036, BB7895411"

| stats list(ProductCode) as ProductdCode by TransactionNumber

So, one event would look like this:

TransactionNumber | ProductCode

000532154 | F1
---------------- SH
---------------- VE
---------------- BB4521036
---------------- BB7895411

065212737 | CT
---------------- 12
---------------- SD
---------------- BB1125364
---------------- BB7885621

044568931 | F6
---------------- 08
---------------- JO
---------------- BB1125364
---------------- BB7885621

I only want to include transactions that includes ProductCodes starting with "F" while keeping the other ProductCodes intact. Thus, the 2nd event not having any product code starting with "F", should be excluded.

0 Karma

Re: Exclude any transaction that doesn't include a specific value

|eval first_val=mvindex(ProductCode,0)| where !LIKE(first_val, "F%")

Couple of points to keep in mind
list only returns the first 100 values , and more than that are you sure F ALWAYS occurs in the first row of the multivalued field?
For instance, can F6 occur after 08 OR JO in the ProductCode multivalued field?

0 Karma