Splunk Search
Highlighted

Search for JSON data that does not contain a field

Path Finder

We are sending Json formatted data into splunk. How can I search for all messages that that DO NOT contain a certain Json field, for e.g. I want to search all messages that don't contain the authorization field (fully qualified as message.request.authorization)?

Tags (3)
0 Karma
Highlighted

Re: Search for JSON data that does not contain a field

Splunk Employee
Splunk Employee

This will work:

NOT message.request.authorization=*

See also http://answers.splunk.com/answers/6981/which-is-better-not-or

View solution in original post

0 Karma