Splunk Search

Why using regex to remove a particular field is not working?

praddasg
Path Finder

I am using the below query and I was able to not get the results which had messages like "Optional.of(The following items are not available for order at this time)" but I found one of the message still appearing "Optional.of(Items quantity is over the maximum quantity)". Not sure if this has anything to do with the regex

REJECTED sourcetype="pos-generic:prod" partner_account_name="Level Up"
| regex message != "item"
| table merchantId, orderId, message
| stats count by merchantId, message

alt text

Tags (1)
0 Karma
1 Solution

vnravikumar
Champion

Hi

Try with following where instead of regex

......| where NOT message like ("%item%") AND NOT message like ("%Item%")|...

View solution in original post

mydog8it
Builder

If you would like to stay with regex I think this will get it for you:

| regex message != "[iI]tem"

vnravikumar
Champion

Hi

Try with following where instead of regex

......| where NOT message like ("%item%") AND NOT message like ("%Item%")|...
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...