How to search for events that do not contain a field, where that field has a period in its name?

[mdufrasne]

I have JSON records.
Some contain the field logdata.message, others contain the field logdata.exception.Message.
I wish to find all the records where logdata.exception.Message does not exist.

Note that both logdata and logdata.exception are parsed as objects containing fields (strings) or other objects.

I tried the approach suggested here (https://answers.splunk.com/answers/59305/how-to-find-records-that-do-not-contain-a-certain-field.htm...) but the following didn't work:

index=appdata level="ERROR" NOT 'logdata.exception'=* NOT 'logdata.exception.Message'=*

Since the fields have periods in their qualified names, I wrapped them in single quotes.

[woodcock · Accepted solution]

You must use double-quotes, not single-quotes. Try this:

index=appdata level="ERROR" NOT ("logdata.exception"="*" OR "logdata.exception.Message"="*")

[gcusello]

Why,if you need events "where logdata.exception.Message does not exist", you used both the conditions?
Bye.
Giuseppe

[sundareshr]

Try this

index=appdata level="ERROR" NOT ('logdata.exception'=* OR 'logdata.exception.Message'=*)

[mdufrasne]

no go - I replaced the OR with AND as well. Neither worked. 😞

[sundareshr]

Does index=appdata level="ERROR" return valid data?