Splunk Search

How to search for events that do not contain a field, where that field has a period in its name?

Explorer

I have JSON records.
Some contain the field logdata.message, others contain the field logdata.exception.Message.
I wish to find all the records where logdata.exception.Message does not exist.

Note that both logdata and logdata.exception are parsed as objects containing fields (strings) or other objects.

I tried the approach suggested here (https://answers.splunk.com/answers/59305/how-to-find-records-that-do-not-contain-a-certain-field.htm...) but the following didn't work:

index=appdata level="ERROR" NOT 'logdata.exception'=* NOT 'logdata.exception.Message'=*

Since the fields have periods in their qualified names, I wrapped them in single quotes.

0 Karma
1 Solution

Esteemed Legend

You must use double-quotes, not single-quotes. Try this:

index=appdata level="ERROR" NOT ("logdata.exception"="*" OR "logdata.exception.Message"="*")

View solution in original post

Esteemed Legend

You must use double-quotes, not single-quotes. Try this:

index=appdata level="ERROR" NOT ("logdata.exception"="*" OR "logdata.exception.Message"="*")

View solution in original post

Legend

Why,if you need events "where logdata.exception.Message does not exist", you used both the conditions?
Bye.
Giuseppe

0 Karma

Legend

Try this

index=appdata level="ERROR" NOT ('logdata.exception'=* OR 'logdata.exception.Message'=*)
0 Karma

Explorer

no go - I replaced the OR with AND as well. Neither worked. 😞

0 Karma

Legend

Does index=appdata level="ERROR" return valid data?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!