Splunk Search

Is there a more efficient way to match multiple values using rex?

richnavis88
Explorer

Hello,  I have to avoid matching several values in a fields.  The following works, but I"m wondering if there is a more efficient way... 
index=wineventlog host="myhost" EventCode=7036 | regex Message!="WMI" | regex Message!="WinHTTP"

Labels (1)
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There are few ways to go.

There first is to put the regex strings in the base search.

index=wineventlog host="myhost" EventCode=7036 Message IN ("*WMI*" "*WinHTTP*")

Another is to combine the regular expressions into a single regex command.

index=wineventlog host="myhost" EventCode=7036 | regex Message!="(WMI)|(WinHTTP)"

Yet another is to extract the desired strings and then filter on them.

index=wineventlog host="myhost" EventCode=7036 
| rex field=Message "(?<msg>WMI)" 
| rex field=Message "(?<msg>WinHTTP)"
| where isnotnull(msg)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

johnhuang
Motivator

Any of these should be much faster with #2 and #3 being incrementally faster than the previous in the order.

1. index=wineventlog host="myhost" EventCode=7036 NOT Message IN ("*WMI*", "*WinHTTP*")
2. index=wineventlog host="myhost" TERM(EventCode=7036) NOT Message IN ("*WMI*", "*WinHTTP*")
3. index=wineventlog host="myhost" TERM(EventCode=7036) NOT WMI NOT WinHTTP NOT Message IN ("*WMI*", "*WinHTTP*")

richgalloway
SplunkTrust
SplunkTrust

There are few ways to go.

There first is to put the regex strings in the base search.

index=wineventlog host="myhost" EventCode=7036 Message IN ("*WMI*" "*WinHTTP*")

Another is to combine the regular expressions into a single regex command.

index=wineventlog host="myhost" EventCode=7036 | regex Message!="(WMI)|(WinHTTP)"

Yet another is to extract the desired strings and then filter on them.

index=wineventlog host="myhost" EventCode=7036 
| rex field=Message "(?<msg>WMI)" 
| rex field=Message "(?<msg>WinHTTP)"
| where isnotnull(msg)
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...