- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Simple question - I don't want to display all lines starts with "E or I or W or F" what's wrong with above regular expression?
Display all lines start with "E or I or W or F"
sourcetype=TAFC_LOG_LINE | regex _raw="^[IEWF]"
Don't display all lines start with "E or I or W or F"
sourcetype=TAFC_LOG_LINE | regex _raw="[^IEWF]"
even with below regex I am always getting lines starts with E
sourcetype=TAFC_LOG_LINE | regex _raw="[^E]"
or Am I doing wrong?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Almost good if you combine your regular expressions:
^[IEWF] will show only the lines starting with I, E, W or F.
To exclude them use ^[^IEWF]
The ^ outside the brackets stands for Start of the string/line
In a Group (between the brackets) it means NOT.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Almost good if you combine your regular expressions:
^[IEWF] will show only the lines starting with I, E, W or F.
To exclude them use ^[^IEWF]
The ^ outside the brackets stands for Start of the string/line
In a Group (between the brackets) it means NOT.
