Splunk Search

How to exclude a list of rex fields, then show a stat?

pwongcha
Explorer

How to exclude a list of rex fields, then show a stat?

Why does PSAPPSRV and GUEST still show up in the result? How do I exclude them?

sourcetype="psoftapp-appsrv" host="csappprd*" 
earliest=10/03/2016:09:00:0 latest=10/03/2016:11:00:0  
NOT (userID=PSAPPSRV OR userID=GUEST )
| rex field=_raw "GetCertificate\]\(3\) Returning context. ID=(?[^,]*)" 
| bucket _time span=1h
| top limit=2 userID by host, _time 
1 Solution

somesoni2
Revered Legend

Though the captured name in the rex command got truncated, I'm assuming it was UserID. So, the field didn't exist in the base search (where you added filter NOT (userID=PSAPPSRV OR userID=GUEST ) ), hence the filter never took place. In fact if the NOT operator was not there, you would have 0 results. You should move the filter after the rex comand when its available. Like this

sourcetype="psoftapp-appsrv" host="csappprd*" 
 earliest=10/03/2016:09:00:0 latest=10/03/2016:11:00:0  
 | rex field=_raw "GetCertificate\]\(3\) Returning context. ID=(?<userID[^,]*)"
| search  NOT (userID=PSAPPSRV OR userID=GUEST ) 
 | bucket _time span=1h
 | top limit=2 userID by host, _time 

View solution in original post

somesoni2
Revered Legend

Though the captured name in the rex command got truncated, I'm assuming it was UserID. So, the field didn't exist in the base search (where you added filter NOT (userID=PSAPPSRV OR userID=GUEST ) ), hence the filter never took place. In fact if the NOT operator was not there, you would have 0 results. You should move the filter after the rex comand when its available. Like this

sourcetype="psoftapp-appsrv" host="csappprd*" 
 earliest=10/03/2016:09:00:0 latest=10/03/2016:11:00:0  
 | rex field=_raw "GetCertificate\]\(3\) Returning context. ID=(?<userID[^,]*)"
| search  NOT (userID=PSAPPSRV OR userID=GUEST ) 
 | bucket _time span=1h
 | top limit=2 userID by host, _time 

pwongcha
Explorer

move the filter after the rex command!!! that works. Thank you verymuch

0 Karma
Get Updates on the Splunk Community!

Machine Learning - Assisted Adaptive Thresholding

Let’s talk thresholding. Have you set up static thresholds? Tired of static thresholds triggering false ...

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

  Ready to master Kubernetes and cloud monitoring like the pros?Join Splunk’s Growth Engineering team for an ...

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...