Splunk Search

Negative substring matching against simple string

nicklbailey
New Member

First, I am completely new to Splunk and the extent of my expertise with the query language is dumb wildcard matching and boolean combinations. I'm more than happy to learn more, but you're going to have to explain it assuming minimal knowledge. More than happy to rtfm, if someone could point me to the part of the manual I should be reading (all of it is not a good answer).

So actual question:
I want to exclude all events where one of the fields contains a substring of the following form: "string-one":"string-two", where string-one and string-two are particular strings of interest. So for example I'd like to match

field: blah blah blah "foo":"bar"

But not

field: blah blah blah "string-one":"string-two"

As an additional note, this is only one filter in a long list of conditions in the query
I've tried a simple :
Field NOT ("*\string-one\":\"string-two\"*")

But it isn't working as I expect

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

There's an extra escape character in your search string. Try Field NOT ("*string-one\":\"string-two\"*") or Field NOT ('*string-one":"string-two"*'). If those fail, try ... | where NOT like(field, '%string-one":"string-two"%') | ....

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...