Splunk Search
Highlighted

How to edit my search to filter out results where the HTTP Referrer contains a Blank or a Dash?

Explorer

I have a search as follows:

(Referrer!="*bing*" AND Referrer!="*google*")

Note: Referrer is the http_referrer field from Apache Logs.

The above includes log entries that have the Referrer as blank and also the one that have a - (dash)

How can I filter out the entries that have dash and blanks as well? I tried the following but it didn't do the trick:

(Referrer!="*bing*" AND Referrer!="*google*" AND Referrer!="\\-" AND Referrer="*")

Please advise

0 Karma
Highlighted

Re: How to edit my search to filter out results where the HTTP Referrer contains a Blank or a Dash?

SplunkTrust
SplunkTrust

Have you tried this?

(Referrer!="*bing*" AND Referrer!="*google*" AND Referrer!="-" AND Referrer!="")
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: How to edit my search to filter out results where the HTTP Referrer contains a Blank or a Dash?

Explorer

Yes, that doesn't filter out entries where the Referrer is set to - (dash)

0 Karma
Highlighted

Re: How to edit my search to filter out results where the HTTP Referrer contains a Blank or a Dash?

Esteemed Legend

Like this:

 (Referrer!="*bing*" AND Referrer!="*google*" | where NOT like(Referrer,"%-%") AND NOT like(Referrer,"%*%")
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.