Splunk Search

How to search for events that do not contain a field, where that field has a period in its name?

mdufrasne
Explorer

I have JSON records.
Some contain the field logdata.message, others contain the field logdata.exception.Message.
I wish to find all the records where logdata.exception.Message does not exist.

Note that both logdata and logdata.exception are parsed as objects containing fields (strings) or other objects.

I tried the approach suggested here (https://answers.splunk.com/answers/59305/how-to-find-records-that-do-not-contain-a-certain-field.htm...) but the following didn't work:

index=appdata level="ERROR" NOT 'logdata.exception'=* NOT 'logdata.exception.Message'=*

Since the fields have periods in their qualified names, I wrapped them in single quotes.

1 Solution

woodcock
Esteemed Legend

You must use double-quotes, not single-quotes. Try this:

index=appdata level="ERROR" NOT ("logdata.exception"="*" OR "logdata.exception.Message"="*")

View solution in original post

woodcock
Esteemed Legend

You must use double-quotes, not single-quotes. Try this:

index=appdata level="ERROR" NOT ("logdata.exception"="*" OR "logdata.exception.Message"="*")

gcusello
SplunkTrust
SplunkTrust

Why,if you need events "where logdata.exception.Message does not exist", you used both the conditions?
Bye.
Giuseppe

0 Karma

sundareshr
Legend

Try this

index=appdata level="ERROR" NOT ('logdata.exception'=* OR 'logdata.exception.Message'=*)
0 Karma

mdufrasne
Explorer

no go - I replaced the OR with AND as well. Neither worked. 😞

0 Karma

sundareshr
Legend

Does index=appdata level="ERROR" return valid data?

0 Karma
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...