Splunk Search

How to exclude a list of rex fields, then show a stat?

pwongcha
Explorer

How to exclude a list of rex fields, then show a stat?

Why does PSAPPSRV and GUEST still show up in the result? How do I exclude them?

sourcetype="psoftapp-appsrv" host="csappprd*" 
earliest=10/03/2016:09:00:0 latest=10/03/2016:11:00:0  
NOT (userID=PSAPPSRV OR userID=GUEST )
| rex field=_raw "GetCertificate\]\(3\) Returning context. ID=(?[^,]*)" 
| bucket _time span=1h
| top limit=2 userID by host, _time 
1 Solution

somesoni2
Revered Legend

Though the captured name in the rex command got truncated, I'm assuming it was UserID. So, the field didn't exist in the base search (where you added filter NOT (userID=PSAPPSRV OR userID=GUEST ) ), hence the filter never took place. In fact if the NOT operator was not there, you would have 0 results. You should move the filter after the rex comand when its available. Like this

sourcetype="psoftapp-appsrv" host="csappprd*" 
 earliest=10/03/2016:09:00:0 latest=10/03/2016:11:00:0  
 | rex field=_raw "GetCertificate\]\(3\) Returning context. ID=(?<userID[^,]*)"
| search  NOT (userID=PSAPPSRV OR userID=GUEST ) 
 | bucket _time span=1h
 | top limit=2 userID by host, _time 

View solution in original post

somesoni2
Revered Legend

Though the captured name in the rex command got truncated, I'm assuming it was UserID. So, the field didn't exist in the base search (where you added filter NOT (userID=PSAPPSRV OR userID=GUEST ) ), hence the filter never took place. In fact if the NOT operator was not there, you would have 0 results. You should move the filter after the rex comand when its available. Like this

sourcetype="psoftapp-appsrv" host="csappprd*" 
 earliest=10/03/2016:09:00:0 latest=10/03/2016:11:00:0  
 | rex field=_raw "GetCertificate\]\(3\) Returning context. ID=(?<userID[^,]*)"
| search  NOT (userID=PSAPPSRV OR userID=GUEST ) 
 | bucket _time span=1h
 | top limit=2 userID by host, _time 

pwongcha
Explorer

move the filter after the rex command!!! that works. Thank you verymuch

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...