Splunk Search

How to exclude a list of rex fields, then show a stat?

Explorer

How to exclude a list of rex fields, then show a stat?

Why does PSAPPSRV and GUEST still show up in the result? How do I exclude them?

sourcetype="psoftapp-appsrv" host="csappprd*" 
earliest=10/03/2016:09:00:0 latest=10/03/2016:11:00:0  
NOT (userID=PSAPPSRV OR userID=GUEST )
| rex field=_raw "GetCertificate\]\(3\) Returning context. ID=(?[^,]*)" 
| bucket _time span=1h
| top limit=2 userID by host, _time 
1 Solution

SplunkTrust
SplunkTrust

Though the captured name in the rex command got truncated, I'm assuming it was UserID. So, the field didn't exist in the base search (where you added filter NOT (userID=PSAPPSRV OR userID=GUEST ) ), hence the filter never took place. In fact if the NOT operator was not there, you would have 0 results. You should move the filter after the rex comand when its available. Like this

sourcetype="psoftapp-appsrv" host="csappprd*" 
 earliest=10/03/2016:09:00:0 latest=10/03/2016:11:00:0  
 | rex field=_raw "GetCertificate\]\(3\) Returning context. ID=(?<userID[^,]*)"
| search  NOT (userID=PSAPPSRV OR userID=GUEST ) 
 | bucket _time span=1h
 | top limit=2 userID by host, _time 

View solution in original post

SplunkTrust
SplunkTrust

Though the captured name in the rex command got truncated, I'm assuming it was UserID. So, the field didn't exist in the base search (where you added filter NOT (userID=PSAPPSRV OR userID=GUEST ) ), hence the filter never took place. In fact if the NOT operator was not there, you would have 0 results. You should move the filter after the rex comand when its available. Like this

sourcetype="psoftapp-appsrv" host="csappprd*" 
 earliest=10/03/2016:09:00:0 latest=10/03/2016:11:00:0  
 | rex field=_raw "GetCertificate\]\(3\) Returning context. ID=(?<userID[^,]*)"
| search  NOT (userID=PSAPPSRV OR userID=GUEST ) 
 | bucket _time span=1h
 | top limit=2 userID by host, _time 

View solution in original post

Explorer

move the filter after the rex command!!! that works. Thank you verymuch

0 Karma