Search character *

[gerbert]

Hello,

I want to make the following search:

index = "myIndex" myfield != "35*"

Is there a way to excluse all values of myfield that start with "35" except "35" itself. so for example i want to exclude:

myfield values:

35457, 35568, 351 but not 35 itself.

I know that in regex you can use "+" to indicate the use of "one or more" matches but I don't know how to use it in a splunk search.

Cheers

Fritz

[gcusello]

Hi @gerbert,

di you tried:

index = "myIndex" myfield="35"

?

Ciao.

Giuseppe

[gerbert]

I need the "!=" in my search because I want to explicitly exclude some values from my search. So replacing "!=" with "=" doesn't help me.

[gcusello]

Hi @gerbert,

let me understand your search need:

• you want to exclude all the values where there 35 but also other,
• you want to take only the exact value "35"

if you want to take only the exact value "35", = is the solution, what are the other need of your search so the = isn't the solution?

Ciao.

Giuseppe

[gerbert]

I do not want the value "35" to be excluded, which would be the case with the search myfield!="35*".

Saying i don't want the "35" excluded is different from saying I want the "35" value.

[gcusello]

Hi @gerbert,

Ok understood!

please try this:

index = "myIndex" (myfield!="35" OR myfield="35")

Ciao.

Giuseppe

[gerbert · Accepted solution]

Thanks for your help but I figured it out. The search:

index = "myIndex" | regex myfield != "^(35).+"

gives me what i want