Splunk Search

How to filter out the account name ending with "$"?

samlinsongguo
Communicator

I have data looks like below

    AccountName
    account1-abc$
    account2-abc$
    account3-xyz$
    account4

I want to filter out the account name end with $ with following query

AccountName!=*$

I expect it only return account4 however it does not return anything. if I do following query

AccountName!=*adc$

it does only return me
account3-xyz$ and account4
Any suggestion why the first search does not do what expected but the second query did what expect? is that because $ is special character?

Thanks in advance

Tags (2)
0 Karma
1 Solution

harishalipaka
Motivator

hi @samlinsongguo

try like this

|makeresults |eval AccountName="account1-abc$" |append [|makeresults |eval AccountName="account2-abc$" ]|append [|makeresults |eval AccountName="account3-xyz$" ]|append [|makeresults |eval AccountName="account4" ] |table AccountName |where NOT  AccountName like ("%$")
Thanks
Harish

View solution in original post

0 Karma

harishalipaka
Motivator

hi @samlinsongguo

try like this

|makeresults |eval AccountName="account1-abc$" |append [|makeresults |eval AccountName="account2-abc$" ]|append [|makeresults |eval AccountName="account3-xyz$" ]|append [|makeresults |eval AccountName="account4" ] |table AccountName |where NOT  AccountName like ("%$")
Thanks
Harish
0 Karma

samlinsongguo
Communicator

tried my log it looks like working thank you for your help

0 Karma
Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...