Splunk Search

Remove only fields that do not have suffix

duesser
Path Finder

Basically I have a search with a lot of fields, similar to this example:

 

 

| makeresults
| eval aa1=1, aa2=2, aa1x=3, aa2x=4, b=5

 

 

from this I would basically like to keep everything except for aa* that does not contain the suffix x. I tried

 

 

| fields -aa* aa*x

 

 

as well as similar approaches, but they do not work:


1) either deleting all aa* (including aa*x)

2) not keeping b or

3)not deleting aa* at all.

I would know how to solve this with regex: "aa.+(?<!x)$" as can be seen here:

https://regex101.com/r/JfVHCJ/latest

Is there any SPL equivalent?

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval aa1=1, aa2=2, aa1x=3, aa2x=4, b=5
| rename aa*x as xaa*x
| fields - aa*
| rename xaa*x as aa*x

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval aa1=1, aa2=2, aa1x=3, aa2x=4, b=5
| rename aa*x as xaa*x
| fields - aa*
| rename xaa*x as aa*x

richgalloway
SplunkTrust
SplunkTrust

Have you tried this?

| makeresults
| eval aa1=1, aa2=2, aa1x=3, aa2x=4, b=5
| fields + aa*x b
---
If this reply helps you, Karma would be appreciated.

duesser
Path Finder

While this is possible, there are a lot of b's in the real search and I am looking for a way to not have to write those out individually. - I would like a negative formulation if possible

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...