Splunk Search

Exclude any transaction that doesn't include a specific value

marxsabandana
Path Finder

I need to filter searches that has a value of "F*" included per transaction number. The transaction number with my search will be composed of multiple product codes. Along with the values starting with "F".

A field name called "ProductCode" has values like: "F1, SH, VE, BB4521036, BB7895411"

| stats list(ProductCode) as ProductdCode by TransactionNumber

So, one event would look like this:

TransactionNumber | ProductCode

000532154 | F1
---------------- SH
---------------- VE
---------------- BB4521036
---------------- BB7895411

065212737 | CT
---------------- 12
---------------- SD
---------------- BB1125364
---------------- BB7885621

044568931 | F6
---------------- 08
---------------- JO
---------------- BB1125364
---------------- BB7885621

I only want to include transactions that includes ProductCodes starting with "F" while keeping the other ProductCodes intact. Thus, the 2nd event not having any product code starting with "F", should be excluded.

0 Karma

Sukisen1981
Champion
|eval first_val=mvindex(ProductCode,0)| where !LIKE(first_val, "F%")

Couple of points to keep in mind
list only returns the first 100 values , and more than that are you sure F ALWAYS occurs in the first row of the multivalued field?
For instance, can F6 occur after 08 OR JO in the ProductCode multivalued field?

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...

Hi friends!    At Splunk, your product success is our top priority. With Enterprise Security (ES), we're here ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...