Splunk Search

How to use search and regex command to filter events

umou7
Explorer

The events have fields like below:

description, code

AAxxxxx, 200

AAxxxx,301

AAxxxx,401

BBxxxx,200

BBxxxx,303

AAxxx, 502

 

I want to filer(do not display) events wih below conditon:

   keyword "AA" is in 'description'  with code=[345]\d{2}

I tried below SPL but not working as I expected.

base search | NOT (search description="*AA*" AND regex code="[345]\d{2}")

Could you guys provide me some suggestions?

 

 

 

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Try this

 

| makeresults
| eval _raw="description,code
AAxxxxx,200
AAxxxx,301
AAxxxx,401
BBxxxx,200
BBxxxx,303
AAxxx,502"
| multikv forceheader=1 
| table description code
| sort description
| eval COMMENT="-----------THIS IS THE LINE YOU WANT BELOW----------"
| where !(match(description, "AA") AND match(code, "[345]\d{2}"))

 

See the last line in the query 

and the first match statement can be "^AA" if you want to match the AA at the start of the string

View solution in original post

0 Karma

umou7
Explorer

@bowesmana 

Thank you very much for your reply.

 This is exactly the result what I want. 

I accept your reply as the solution.  ^_~

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Try this

 

| makeresults
| eval _raw="description,code
AAxxxxx,200
AAxxxx,301
AAxxxx,401
BBxxxx,200
BBxxxx,303
AAxxx,502"
| multikv forceheader=1 
| table description code
| sort description
| eval COMMENT="-----------THIS IS THE LINE YOU WANT BELOW----------"
| where !(match(description, "AA") AND match(code, "[345]\d{2}"))

 

See the last line in the query 

and the first match statement can be "^AA" if you want to match the AA at the start of the string

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...