Splunk Search

How to filter out the account name ending with "$"?

samlinsongguo
Communicator

I have data looks like below

    AccountName
    account1-abc$
    account2-abc$
    account3-xyz$
    account4

I want to filter out the account name end with $ with following query

AccountName!=*$

I expect it only return account4 however it does not return anything. if I do following query

AccountName!=*adc$

it does only return me
account3-xyz$ and account4
Any suggestion why the first search does not do what expected but the second query did what expect? is that because $ is special character?

Thanks in advance

Tags (2)
0 Karma
1 Solution

harishalipaka
Motivator

hi @samlinsongguo

try like this

|makeresults |eval AccountName="account1-abc$" |append [|makeresults |eval AccountName="account2-abc$" ]|append [|makeresults |eval AccountName="account3-xyz$" ]|append [|makeresults |eval AccountName="account4" ] |table AccountName |where NOT  AccountName like ("%$")
Thanks
Harish

View solution in original post

0 Karma

harishalipaka
Motivator

hi @samlinsongguo

try like this

|makeresults |eval AccountName="account1-abc$" |append [|makeresults |eval AccountName="account2-abc$" ]|append [|makeresults |eval AccountName="account3-xyz$" ]|append [|makeresults |eval AccountName="account4" ] |table AccountName |where NOT  AccountName like ("%$")
Thanks
Harish
0 Karma

samlinsongguo
Communicator

tried my log it looks like working thank you for your help

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...