Search for a field not containing a specific pattern.

[tdismukes]

I have two indexed fields, FieldX and FieldY. I want to search for all instances of FieldX that contain 'ABC' where FieldY does not contain '123'. I assume the format would start something like:

FieldX=ABC AND FieldY

but I don't know how to finish that. Would someone please help me out?

[Nayra_bakshi]

what to refer to if want to search on the whole payload/Raw logs, not in a particular field?

[somesoni2 · Accepted solution]

Try something like this

FieldX="*ABC*" NOT FieldY="*123*"

[Nayra_bakshi]

What to refer if on whole payload without any fields ?

[PickleRick]

Firstly, let me point out that you're trying to resurrect an 8 year old thread. Next time, start a new one with your question - you'll get better chance of reply.

Back to your question - if you want to find all events which don't contain the string "abc" _anywhere_ within the raw event, simply search for

NOT *abc*

Having said that - it's not the best way to search. If you search for something containing wildcard at the beginning of the search term (either as a straight search or a negative search like in our case) splunk has to scan all raw events to verify whether the event matches. It cannot use internal indexes of words to find only a subset of events which matches the condition.

Therefore you should, whenever possible, search for fixed strings.

And remember that while indexing events splunk splits them into words on whitespaces and punctuators. So "abc" will match both "abc def" as well as "whatever.abc.ding-dong".

Wildcards are often overused in splunk search and they might incur huge performance penalty.

[tdismukes]

That was exactly what I needed, thanks.

[Jeff_Lightly_Sp]

Didn't see (or at least comprehend) the words 'contain'. That certainly could matter!

[Jeff_Lightly_Sp]

How about:

Your_SourceType (FieldX=ABC AND FieldY!=123)