Splunk Search

Search for logs which are NOT key value


Does anyone have a data curation search that I snag? Looking for logs and values which are not currently done in key values.

Tags (3)
0 Karma


Did you try...

 your search ... key!=value

This should give the events which doesnt have the values for the key specified above.

0 Karma


Hi daniel333, Check out the Patterns tab : http://docs.splunk.com/Documentation/Splunk/6.3.0/Search/Identifyeventpatterns

Search on a particular source or sourcetype, and it will give you an idea of what kind of events are in that data. At that point you might be able to pick out fields that you can build extractions on.

Let me know if this helps!

0 Karma