Excluding log entries based on specific String in msg field

[bblackmon]

Hi,

I have a problem excluding or including only entries that contain specific String values in the msg field. For example, there are two (maybe more) definite String values contained in the msg field:

1. "GET /ecc/v1/content/preLoginBanners HTTP/1.0"

2. "GET /ecc/v1/content/category/LegalTerms HTTP/1.0"

I need 3 statements like the following:

1. Include ONLY 1 above in the msg field.

2. Include ONLY 2 above in the msg field.

3. Exclude 1 and 2 above to determine if there are more unknown values in the msg field. 

I imagine I will be using thistype of  logic more on other output fields as time goes on.

I am new to this and I am using the XML-based AdHoc Search input/output form. Any help is greatly appreciated!

[PickleRick]

OK. You're mixing so many different things here that I'm not really sure what you want.

You posted this in "Getting Data In" section which typically deals with issues regarding ingesting data from sources into Splunk.

You labeled your post with "field extraction" but doesn't mention the extraction in the contents - are your fields properly extracted? Do you need to extract them before searching?

And your post is clearly about searching as such. But mentions something you call "XML-based AdHoc Search input/output form". What do you mean?

I suggest you check out the "Intro to Splunk" free course on the STEP education portal (see https://www.splunk.com/en_us/training/course-catalog.html )