Finding events that do not contain a specific string

[teedilo]

We have some issues with line breaking such that we have events that often consist of multiple logical events, or they might consist of fragments of logical records.  We've tried a variety of fixes but no joy so far.  Anyway, that's not really what my question is about.  I'm trying to do a Splunk search that finds only "good" events as in "Scenario 1" below, where the event begins with the XML tag <record> and ends with </record>.  There should be no other tags like this in the event, which would indicate an event like in "Scenario 2", which contains multiple logical events merged together.  

Scenario 1:

<record>
blah blah
blah
</record>

Scenario 2:

<record>blah blah
blah</record>
<record>
blah
blah blah</record>
<record>
blah
blah blah</record>

I learned that this can be accomplished outside of Splunk using a "negative lookbehind".  I tried this in a Splunk search like the one below.

| regex "(?s)^<record>((?!<record>)(\s|\S))*<\/record>$"

I couldn't get this to work, however.  This does work as expected in regex101:

• Scenario 1 (match)
• Scenario 2 (no match)

Any ideas?  I used the regex command instead of the rex command because I didn't need to extract anything.  Thanks in advance.

[ITWhisperer · Accepted solution]

Technically, you are using a negative lookahead not lookbehind, but it is what you want. Which version of splunk are you using as this works on 8.1.3 and 7.3.3

| makeresults 
| eval events=split("<record>
blah blah
blah
</record>|<record>blah blah
blah</record>
<record>
blah
blah blah</record>
<record>
blah
blah blah</record>","|")
| mvexpand events
| rename events as _raw
| regex "(?s)^<record>((?!<record>)(\s|\S))*<\/record>$"

[teedilo]

Thanks for clarifying on the terminology.  I had copied the terminology from another posting so they must have misused it as well.  In any case, good to know it works in a newer version of Splunk.  I was afraid you'd ask which version of Splunk we're on because I'm embarrassed to say that we're still on 5.0.1.  We've had no end of difficulties upgrading and dealing with other problems in Splunk.  IMHO Splunk is a very difficult product to administer and we just don't have the time it apparently takes to do a good job with it.  Thanks for trying to help anyway.