Splunk Search

Exclude regex results from a search

Explorer

Hello,

I'm trying to run the following search in order to list all the failed connection.

In our parc we have computers that start with Q and immediately followed by a number. So I know the following search (without the NOT) shows only these computers.

source="WinEventLog:Security" "CategoryString=Ouverture/fermeture" "Type=Failure" Type="Failure Audit" NOT regex host="Q[0-9].*" | stats count by host

But when I add the NOT it doesn't display anything what am I doing wrong ?

Thanks,
Gaetan

Tags (2)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

Do this instead:

source="WinEventLog:Security" "CategoryString=Ouverture/fermeture" "Type=Failure" Type="Failure Audit" | regex host!="Q[0-9].*" | stats count by host

Because regex is a command and the way you have it is: NOT regex AND host="![0-9]"

View solution in original post

Splunk Employee
Splunk Employee

Do this instead:

source="WinEventLog:Security" "CategoryString=Ouverture/fermeture" "Type=Failure" Type="Failure Audit" | regex host!="Q[0-9].*" | stats count by host

Because regex is a command and the way you have it is: NOT regex AND host="![0-9]"

View solution in original post

Explorer

Works like a charm! Thanks a lot

0 Karma