Splunk Search

How to use search and regex command to filter events

umou7
Explorer

The events have fields like below:

description, code

AAxxxxx, 200

AAxxxx,301

AAxxxx,401

BBxxxx,200

BBxxxx,303

AAxxx, 502

 

I want to filer(do not display) events wih below conditon:

   keyword "AA" is in 'description'  with code=[345]\d{2}

I tried below SPL but not working as I expected.

base search | NOT (search description="*AA*" AND regex code="[345]\d{2}")

Could you guys provide me some suggestions?

 

 

 

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Try this

 

| makeresults
| eval _raw="description,code
AAxxxxx,200
AAxxxx,301
AAxxxx,401
BBxxxx,200
BBxxxx,303
AAxxx,502"
| multikv forceheader=1 
| table description code
| sort description
| eval COMMENT="-----------THIS IS THE LINE YOU WANT BELOW----------"
| where !(match(description, "AA") AND match(code, "[345]\d{2}"))

 

See the last line in the query 

and the first match statement can be "^AA" if you want to match the AA at the start of the string

View solution in original post

0 Karma

umou7
Explorer

@bowesmana 

Thank you very much for your reply.

 This is exactly the result what I want. 

I accept your reply as the solution.  ^_~

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Try this

 

| makeresults
| eval _raw="description,code
AAxxxxx,200
AAxxxx,301
AAxxxx,401
BBxxxx,200
BBxxxx,303
AAxxx,502"
| multikv forceheader=1 
| table description code
| sort description
| eval COMMENT="-----------THIS IS THE LINE YOU WANT BELOW----------"
| where !(match(description, "AA") AND match(code, "[345]\d{2}"))

 

See the last line in the query 

and the first match statement can be "^AA" if you want to match the AA at the start of the string

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...