Splunk Search

Find records with a certain field defined

ibmbaranski
Engager

I'm looking for records that have a "user_email" field defined and not equal to "unauthenticated"

 

How do I do this:

 

search index=xyz sourcetype=abc (NOT user_email=unauthenticated AND user_email=*)

This does not appear to be working - I get loads of records with no user_email field defined?

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this:

search index=xyz sourcetype=abc user_email=* NOT user_email=unauthenticated

AND is implied in the search

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this:

search index=xyz sourcetype=abc user_email=* NOT user_email=unauthenticated

AND is implied in the search

codebuilder
SplunkTrust
SplunkTrust

Simple yet elegant solution. Love it!

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...