The events have fields like below:
description, code
AAxxxxx, 200
AAxxxx,301
AAxxxx,401
BBxxxx,200
BBxxxx,303
AAxxx, 502
I want to filer(do not display) events wih below conditon:
keyword "AA" is in 'description' with code=[345]\d{2}
I tried below SPL but not working as I expected.
base search | NOT (search description="*AA*" AND regex code="[345]\d{2}")
Could you guys provide me some suggestions?
Try this
| makeresults
| eval _raw="description,code
AAxxxxx,200
AAxxxx,301
AAxxxx,401
BBxxxx,200
BBxxxx,303
AAxxx,502"
| multikv forceheader=1
| table description code
| sort description
| eval COMMENT="-----------THIS IS THE LINE YOU WANT BELOW----------"
| where !(match(description, "AA") AND match(code, "[345]\d{2}"))
See the last line in the query
and the first match statement can be "^AA" if you want to match the AA at the start of the string
Thank you very much for your reply.
This is exactly the result what I want.
I accept your reply as the solution. ^_~
Try this
| makeresults
| eval _raw="description,code
AAxxxxx,200
AAxxxx,301
AAxxxx,401
BBxxxx,200
BBxxxx,303
AAxxx,502"
| multikv forceheader=1
| table description code
| sort description
| eval COMMENT="-----------THIS IS THE LINE YOU WANT BELOW----------"
| where !(match(description, "AA") AND match(code, "[345]\d{2}"))
See the last line in the query
and the first match statement can be "^AA" if you want to match the AA at the start of the string