Splunk Search

Querying for values without a specific character?

yepyepyayyooo
New Member

Attempting to create a query that will return all values that do not have a . (dot) in their file name, meaning no file extension. Does anyone know of a way of achieving this? Seems simple but I can't figure it out. The query is a combination of terms that do have file extensions so I can't use filename!=".".

Tags (1)
0 Karma

vnravikumar
Champion

Hi

Give a try

| makeresults 
| eval file="test.txt,test1,temp.csv,test3" 
| makemv delim="," file 
| mvexpand file 
| where isnull(mvindex(split(file,"."),1))

New: Try this filters only file name

| makeresults 
| eval file="test.txt,test1,temp.csv,test3" 
| makemv delim="," file 
| mvexpand file 
| rex field=file "(?P<filename>[^.]+)"
0 Karma

harshpatel
Contributor

can you please give example list of filenames and tell us what you want to filter out?

0 Karma

yepyepyayyooo
New Member

They're unknown. Basically you have filename1.doc and filename1.txt. I'm looking to return all values that are filename1 (no file extension)

0 Karma

harshpatel
Contributor

so you want to remove file extensions and return only filenames?

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.