Splunk Search

How to use search and regex command to filter events

umou7
Explorer

The events have fields like below:

description, code

AAxxxxx, 200

AAxxxx,301

AAxxxx,401

BBxxxx,200

BBxxxx,303

AAxxx, 502

 

I want to filer(do not display) events wih below conditon:

   keyword "AA" is in 'description'  with code=[345]\d{2}

I tried below SPL but not working as I expected.

base search | NOT (search description="*AA*" AND regex code="[345]\d{2}")

Could you guys provide me some suggestions?

 

 

 

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Try this

 

| makeresults
| eval _raw="description,code
AAxxxxx,200
AAxxxx,301
AAxxxx,401
BBxxxx,200
BBxxxx,303
AAxxx,502"
| multikv forceheader=1 
| table description code
| sort description
| eval COMMENT="-----------THIS IS THE LINE YOU WANT BELOW----------"
| where !(match(description, "AA") AND match(code, "[345]\d{2}"))

 

See the last line in the query 

and the first match statement can be "^AA" if you want to match the AA at the start of the string

View solution in original post

0 Karma

umou7
Explorer

@bowesmana 

Thank you very much for your reply.

 This is exactly the result what I want. 

I accept your reply as the solution.  ^_~

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Try this

 

| makeresults
| eval _raw="description,code
AAxxxxx,200
AAxxxx,301
AAxxxx,401
BBxxxx,200
BBxxxx,303
AAxxx,502"
| multikv forceheader=1 
| table description code
| sort description
| eval COMMENT="-----------THIS IS THE LINE YOU WANT BELOW----------"
| where !(match(description, "AA") AND match(code, "[345]\d{2}"))

 

See the last line in the query 

and the first match statement can be "^AA" if you want to match the AA at the start of the string

0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...