Splunk Search

Is there a more efficient way to match multiple values using rex?

richnavis88
Explorer

Hello,  I have to avoid matching several values in a fields.  The following works, but I"m wondering if there is a more efficient way... 
index=wineventlog host="myhost" EventCode=7036 | regex Message!="WMI" | regex Message!="WinHTTP"

Labels (1)
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There are few ways to go.

There first is to put the regex strings in the base search.

index=wineventlog host="myhost" EventCode=7036 Message IN ("*WMI*" "*WinHTTP*")

Another is to combine the regular expressions into a single regex command.

index=wineventlog host="myhost" EventCode=7036 | regex Message!="(WMI)|(WinHTTP)"

Yet another is to extract the desired strings and then filter on them.

index=wineventlog host="myhost" EventCode=7036 
| rex field=Message "(?<msg>WMI)" 
| rex field=Message "(?<msg>WinHTTP)"
| where isnotnull(msg)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

johnhuang
Motivator

Any of these should be much faster with #2 and #3 being incrementally faster than the previous in the order.

1. index=wineventlog host="myhost" EventCode=7036 NOT Message IN ("*WMI*", "*WinHTTP*")
2. index=wineventlog host="myhost" TERM(EventCode=7036) NOT Message IN ("*WMI*", "*WinHTTP*")
3. index=wineventlog host="myhost" TERM(EventCode=7036) NOT WMI NOT WinHTTP NOT Message IN ("*WMI*", "*WinHTTP*")

richgalloway
SplunkTrust
SplunkTrust

There are few ways to go.

There first is to put the regex strings in the base search.

index=wineventlog host="myhost" EventCode=7036 Message IN ("*WMI*" "*WinHTTP*")

Another is to combine the regular expressions into a single regex command.

index=wineventlog host="myhost" EventCode=7036 | regex Message!="(WMI)|(WinHTTP)"

Yet another is to extract the desired strings and then filter on them.

index=wineventlog host="myhost" EventCode=7036 
| rex field=Message "(?<msg>WMI)" 
| rex field=Message "(?<msg>WinHTTP)"
| where isnotnull(msg)
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...