Splunk Search

How can I filter results for type 2 only?

lamnguyentt1
Explorer

Dear Professional,

I have a Search string like below

index="hcg_oapi_prod" relatedPersons
| regex "\"relatedPersons\":\[\]"

And this is the result

splunk-2.PNG

 

The result have to type:

Type 1: Results has value {"name":{"firstName":"xxx","middleName":"xxx","lastName":"xxx"}

Type 2: Results dose not have value {"name":{"firstName":"xxx","middleName":"xxx","lastName":"xxx"}

How can I filter results for type 2 only? (dose not have value {"name":{"firstName":"xxx","middleName":"xxx","lastName":"xxx"})

Thank you.

Labels (4)
Tags (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

As I said, it's using AND for those the words, so neither of those two records have 'middleName', so it is not ignored. If you want to use OR, then add OR between each of the words

 

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Note that NOT searches are not the most efficient, but you could do

index="hcg_oapi_prod" relatedPersons NOT (firstName middleName lastName)
| regex "\"relatedPersons\":\[\]"

That is doing AND between the 3 words and then NOT those, so all have to be present for those events to be ignored.

 

0 Karma

lamnguyentt1
Explorer

Dear @bowesmana,

Thank you for your reply, but it still does not work.

Please help me.

lamnguyentt1_0-1648009344942.png

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

As I said, it's using AND for those the words, so neither of those two records have 'middleName', so it is not ignored. If you want to use OR, then add OR between each of the words

 

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...