Splunk Search

Splunk query help - query for URL that have values other than X,Y,Z

Splunkanator
New Member

Lets say i would like to query for message that has a URL field with values other than X,Y,Z added as query parameters , how do i go about this ?

TIA

Labels (2)
0 Karma

tscroggins
Influencer

Hi @Splunkanator,

If your events have an extracted uri_query field, which is typical for e.g. NCSA and W3C log formats, you can use != or NOT to exclude events:

index=main sourcetype=access_common uri_query!=*param=X* uri_query!=*param=Y* uri_query!=*param=Z*

or

index=main sourcetype=access_common NOT uri_query IN (*param=X* *param=Y* *param=Z*)

However, those will exclude events with partially matching names or values.

Performance will vary, but you can use the regex command to match events with fields that do no match a regular expression:

index=main sourcetype=access_common
| regex uri_query!="(^|&)param=(X|Y|Z)(&|$)"

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Splunkanator 

Can you please share some sample events and expected output?

KV

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...