Splunk Search

How to use search and regex command to filter events

umou7
Explorer

The events have fields like below:

description, code

AAxxxxx, 200

AAxxxx,301

AAxxxx,401

BBxxxx,200

BBxxxx,303

AAxxx, 502

 

I want to filer(do not display) events wih below conditon:

   keyword "AA" is in 'description'  with code=[345]\d{2}

I tried below SPL but not working as I expected.

base search | NOT (search description="*AA*" AND regex code="[345]\d{2}")

Could you guys provide me some suggestions?

 

 

 

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Try this

 

| makeresults
| eval _raw="description,code
AAxxxxx,200
AAxxxx,301
AAxxxx,401
BBxxxx,200
BBxxxx,303
AAxxx,502"
| multikv forceheader=1 
| table description code
| sort description
| eval COMMENT="-----------THIS IS THE LINE YOU WANT BELOW----------"
| where !(match(description, "AA") AND match(code, "[345]\d{2}"))

 

See the last line in the query 

and the first match statement can be "^AA" if you want to match the AA at the start of the string

View solution in original post

0 Karma

umou7
Explorer

@bowesmana 

Thank you very much for your reply.

 This is exactly the result what I want. 

I accept your reply as the solution.  ^_~

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Try this

 

| makeresults
| eval _raw="description,code
AAxxxxx,200
AAxxxx,301
AAxxxx,401
BBxxxx,200
BBxxxx,303
AAxxx,502"
| multikv forceheader=1 
| table description code
| sort description
| eval COMMENT="-----------THIS IS THE LINE YOU WANT BELOW----------"
| where !(match(description, "AA") AND match(code, "[345]\d{2}"))

 

See the last line in the query 

and the first match statement can be "^AA" if you want to match the AA at the start of the string

0 Karma
Get Updates on the Splunk Community!

The Payment Operations Wake-Up Call: Why Financial Institutions Can't Afford ...

The same scenario plays out across financial institutions daily. A payment system fails at 11:30 AM on a busy ...

Make Your Case: A Ready-to-Send Letter for Getting Approval to Attend .conf25

Hello Splunkers, Want to attend .conf25 in Boston this year but not sure how to convince your manager? We've ...

Community Spotlight: A Splunk Expert's Journey

In the world of data analytics, some journeys leave a lasting impact not only on the individual but on the ...