Splunk Search

Search for a field not containing a specific pattern.

tdismukes
Engager

I have two indexed fields, FieldX and FieldY. I want to search for all instances of FieldX that contain 'ABC' where FieldY does not contain '123'. I assume the format would start something like:

FieldX=ABC AND FieldY

but I don't know how to finish that. Would someone please help me out?

Tags (1)
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try something like this

FieldX="*ABC*" NOT FieldY="*123*"

View solution in original post

Nayra_bakshi
Engager

what to refer to if want to search on the whole payload/Raw logs, not in a particular field?

 

 

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try something like this

FieldX="*ABC*" NOT FieldY="*123*"

Nayra_bakshi
Engager

What to refer if on whole payload without any fields ?

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Firstly, let me point out that you're trying to resurrect an 8 year old thread. Next time, start a new one with your question - you'll get better chance of reply.

Back to your question - if you want to find all events which don't contain the string "abc" _anywhere_ within the raw event, simply search for

NOT *abc*

Having said that - it's not the best way to search. If you search for something containing wildcard at the beginning of the search term (either as a straight search or a negative search like in our case) splunk has to scan all raw events to verify whether the event matches. It cannot use internal indexes of words to find only a subset of events which matches the condition.

Therefore you should, whenever possible, search for fixed strings.

And remember that while indexing events splunk splits them into words on whitespaces and punctuators. So "abc" will match both "abc def" as well as "whatever.abc.ding-dong".

Wildcards are often overused in splunk search and they might incur huge performance penalty.

tdismukes
Engager

That was exactly what I needed, thanks.

0 Karma

Jeff_Lightly_Sp
Communicator

Didn't see (or at least comprehend) the words 'contain'. That certainly could matter!

0 Karma

Jeff_Lightly_Sp
Communicator

How about:

Your_SourceType (FieldX=ABC AND FieldY!=123)
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...