Splunk Search

Is there a more efficient way to match multiple values using rex?

richnavis88
Explorer

Hello,  I have to avoid matching several values in a fields.  The following works, but I"m wondering if there is a more efficient way... 
index=wineventlog host="myhost" EventCode=7036 | regex Message!="WMI" | regex Message!="WinHTTP"

Labels (1)
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There are few ways to go.

There first is to put the regex strings in the base search.

index=wineventlog host="myhost" EventCode=7036 Message IN ("*WMI*" "*WinHTTP*")

Another is to combine the regular expressions into a single regex command.

index=wineventlog host="myhost" EventCode=7036 | regex Message!="(WMI)|(WinHTTP)"

Yet another is to extract the desired strings and then filter on them.

index=wineventlog host="myhost" EventCode=7036 
| rex field=Message "(?<msg>WMI)" 
| rex field=Message "(?<msg>WinHTTP)"
| where isnotnull(msg)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

johnhuang
Motivator

Any of these should be much faster with #2 and #3 being incrementally faster than the previous in the order.

1. index=wineventlog host="myhost" EventCode=7036 NOT Message IN ("*WMI*", "*WinHTTP*")
2. index=wineventlog host="myhost" TERM(EventCode=7036) NOT Message IN ("*WMI*", "*WinHTTP*")
3. index=wineventlog host="myhost" TERM(EventCode=7036) NOT WMI NOT WinHTTP NOT Message IN ("*WMI*", "*WinHTTP*")

richgalloway
SplunkTrust
SplunkTrust

There are few ways to go.

There first is to put the regex strings in the base search.

index=wineventlog host="myhost" EventCode=7036 Message IN ("*WMI*" "*WinHTTP*")

Another is to combine the regular expressions into a single regex command.

index=wineventlog host="myhost" EventCode=7036 | regex Message!="(WMI)|(WinHTTP)"

Yet another is to extract the desired strings and then filter on them.

index=wineventlog host="myhost" EventCode=7036 
| rex field=Message "(?<msg>WMI)" 
| rex field=Message "(?<msg>WinHTTP)"
| where isnotnull(msg)
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...