Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to search for events that do not contain a fie...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have JSON records.
Some contain the field logdata.message, others contain the field logdata.exception.Message.
I wish to find all the records where logdata.exception.Message does not exist.
Note that both logdata and logdata.exception are parsed as objects containing fields (strings) or other objects.
I tried the approach suggested here (https://answers.splunk.com/answers/59305/how-to-find-records-that-do-not-contain-a-certain-field.htm...) but the following didn't work:
index=appdata level="ERROR" NOT 'logdata.exception'=* NOT 'logdata.exception.Message'=*
Since the fields have periods in their qualified names, I wrapped them in single quotes.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You must use double-quotes, not single-quotes. Try this:
index=appdata level="ERROR" NOT ("logdata.exception"="*" OR "logdata.exception.Message"="*")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You must use double-quotes, not single-quotes. Try this:
index=appdata level="ERROR" NOT ("logdata.exception"="*" OR "logdata.exception.Message"="*")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Why,if you need events "where logdata.exception.Message does not exist", you used both the conditions?
Bye.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this
index=appdata level="ERROR" NOT ('logdata.exception'=* OR 'logdata.exception.Message'=*)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
no go - I replaced the OR with AND as well. Neither worked. 😞
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does index=appdata level="ERROR" return valid data?
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
