Splunk Search

How to use "NOT" condition in regular expression?

Madhan45
Path Finder

for example i have the string "update event from remote cache". i need to use NOT condition for this to capture ab events other than that.

Tags (1)
0 Karma

bmacias84
Champion

You might want to look at rex Non-capturing which may do what you want with some rex trickery, but with out some samples its tough to tell. http://www.regular-expressions.info/refcapture.html

0 Karma

woodcock
Esteemed Legend

Does this not work (you MUST use ALL-CAPS for NOT)?

NOT "event from remote cache"

jeffland
SplunkTrust
SplunkTrust

Maybe this answer on Stack Overflow is of interest to you.

But maybe you could just eval a field which flags events with your given string and filter based on that eval'd field, such as

your_search | eval check=if(match(field, "update\sevent\sfrom\sremote\scache","nope","ok") | where check="ok"

PS: this assumes that your string in question is in a field named "field".

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...