Splunk Search

How to use search and regex command to filter events

umou7
Explorer

The events have fields like below:

description, code

AAxxxxx, 200

AAxxxx,301

AAxxxx,401

BBxxxx,200

BBxxxx,303

AAxxx, 502

 

I want to filer(do not display) events wih below conditon:

   keyword "AA" is in 'description'  with code=[345]\d{2}

I tried below SPL but not working as I expected.

base search | NOT (search description="*AA*" AND regex code="[345]\d{2}")

Could you guys provide me some suggestions?

 

 

 

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Try this

 

| makeresults
| eval _raw="description,code
AAxxxxx,200
AAxxxx,301
AAxxxx,401
BBxxxx,200
BBxxxx,303
AAxxx,502"
| multikv forceheader=1 
| table description code
| sort description
| eval COMMENT="-----------THIS IS THE LINE YOU WANT BELOW----------"
| where !(match(description, "AA") AND match(code, "[345]\d{2}"))

 

See the last line in the query 

and the first match statement can be "^AA" if you want to match the AA at the start of the string

View solution in original post

0 Karma

umou7
Explorer

@bowesmana 

Thank you very much for your reply.

 This is exactly the result what I want. 

I accept your reply as the solution.  ^_~

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Try this

 

| makeresults
| eval _raw="description,code
AAxxxxx,200
AAxxxx,301
AAxxxx,401
BBxxxx,200
BBxxxx,303
AAxxx,502"
| multikv forceheader=1 
| table description code
| sort description
| eval COMMENT="-----------THIS IS THE LINE YOU WANT BELOW----------"
| where !(match(description, "AA") AND match(code, "[345]\d{2}"))

 

See the last line in the query 

and the first match statement can be "^AA" if you want to match the AA at the start of the string

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...