Splunk Search

How to filter out search results where a field value ends with the $ character?

Bytes
Explorer

Hello Everyone,

Am hitting a snag and need some help. So I have an index whereby we have many account names returned to us from an index. Some of these account names end in the $ character.

I am trying to filter any events where the account name ends in $ out of the result set.

I have tried search NOT account_name = "*$" but this doesn't seem to work. I am guessing that $ is a reserved character or something as this works fine when filtering out other stuff not ending in a special character.

Anyone got any hints for me? I would really appreciate it.

1 Solution

javiergn
Super Champion

I'm assuming the answer below works fine but if not try the following:

| where NOT LIKE(field,"%$")

View solution in original post

weicai88
Path Finder

This should work:

account_name != "*$"

0 Karma

javiergn
Super Champion

I'm assuming the answer below works fine but if not try the following:

| where NOT LIKE(field,"%$")

Bytes
Explorer

Hi All,

Thanks for your responses. I found the problem. After exploring the events that Splunk was indexing I found that the account_name atribute had two values. One of the user who created the event (what I was after) and one of the AD machine account (ending $ that I was trying to filter out). Basically when I ran your (and my) search strings they were working but all acount_name atributes had a value ending $.

As such, I explored and found another atribute that only has the user name (and no machine name). Performing both your functions on that worked well.

Both your answers work to do what I asked though so thank you :slightly_smiling_face:

0 Karma

sundareshr
Legend

Have you tried using NOT "*\$"?

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...