Splunk Search

How can I return events with excluded field value combined with all events that have no value for that field?

foxglove
Engager

Hello all.

I've been having some trouble with a tricky query. Essentially, I want to return all events that contain a certain field, with a specific value excluded, and combine that with all events that also contain nothing for that particular field.

For excluding the field value, I would use:

 

 

... field!=value

 

 

And for all events that do not have a value for that field, I would use:

 

 

... NOT field="*"

 

 

I have no idea how to combine these, as one requires the field and the other completely excludes it. I have tried:

 

 

<search> field!=value
 | fields -field

 

 

But it doesn't work, as I believe I'm basically applying a filter but doing nothing with it.

Any help will be greatly appreciated! Thank you.

Labels (3)
0 Karma
1 Solution

2ero
Engager

I believe what you're looking to do should be implicitly solved by searching

 

NOT field=value

 

 

When searching with != you are also telling Splunk to only return results with a valid entry for that field. Take a look at the documentation for Difference between != and NOT for an in-depth  breakdown of the differences.

But @foxglove your question is a bit ambiguous, are you searching against two separate fields, looking for both null/nonexistent value and non-excluded values, or only null/nonexistent values that also don't match the searched value?

View solution in original post

2ero
Engager

I believe what you're looking to do should be implicitly solved by searching

 

NOT field=value

 

 

When searching with != you are also telling Splunk to only return results with a valid entry for that field. Take a look at the documentation for Difference between != and NOT for an in-depth  breakdown of the differences.

But @foxglove your question is a bit ambiguous, are you searching against two separate fields, looking for both null/nonexistent value and non-excluded values, or only null/nonexistent values that also don't match the searched value?

foxglove
Engager

Apologies for the ambiguity. I did mean the same field. Your solution is what I was looking for, so thank you. I forgot about the implicit nature of NOT in that it excludes all events that have a particular value for that field, which would include all events that do not any value for that field at all. Thanks again!

Tags (1)

bowesmana
SplunkTrust
SplunkTrust

So you want this?

search .... (field!=value OR NOT field=*)

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...