Splunk Search

Search for a field not containing a specific pattern.

tdismukes
Engager

I have two indexed fields, FieldX and FieldY. I want to search for all instances of FieldX that contain 'ABC' where FieldY does not contain '123'. I assume the format would start something like:

FieldX=ABC AND FieldY

but I don't know how to finish that. Would someone please help me out?

Tags (1)
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try something like this

FieldX="*ABC*" NOT FieldY="*123*"

View solution in original post

Nayra_bakshi
Engager

what to refer to if want to search on the whole payload/Raw logs, not in a particular field?

 

 

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try something like this

FieldX="*ABC*" NOT FieldY="*123*"

Nayra_bakshi
Engager

What to refer if on whole payload without any fields ?

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Firstly, let me point out that you're trying to resurrect an 8 year old thread. Next time, start a new one with your question - you'll get better chance of reply.

Back to your question - if you want to find all events which don't contain the string "abc" _anywhere_ within the raw event, simply search for

NOT *abc*

Having said that - it's not the best way to search. If you search for something containing wildcard at the beginning of the search term (either as a straight search or a negative search like in our case) splunk has to scan all raw events to verify whether the event matches. It cannot use internal indexes of words to find only a subset of events which matches the condition.

Therefore you should, whenever possible, search for fixed strings.

And remember that while indexing events splunk splits them into words on whitespaces and punctuators. So "abc" will match both "abc def" as well as "whatever.abc.ding-dong".

Wildcards are often overused in splunk search and they might incur huge performance penalty.

tdismukes
Engager

That was exactly what I needed, thanks.

0 Karma

Jeff_Lightly_Sp
Communicator

Didn't see (or at least comprehend) the words 'contain'. That certainly could matter!

0 Karma

Jeff_Lightly_Sp
Communicator

How about:

Your_SourceType (FieldX=ABC AND FieldY!=123)
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...