Splunk Search

How to filter out a specific phrase in a Splunk search

frodelauka
Observer

I'm trying to search for a specific phrase with the search below but I only want result1, not result2. The issue here, I guess, is that parts of the phrase I'm searching for is present in both results (same phrase marked in bold) ->

Search:

index=example host=example message_name=* AND profileId="xxxx-xxxxx-xxxxx" AND "deviceClass":"example" AND "Message received: {"name":"screenView","screenName":"assetcard""

Result1:

MessageReceiver:96 - Message received: {"name":"screenView","screenName":"assetcard","previous":{"name":"screenView","screenName":"homeScreen","subscreenName":"STB.TOP.HOME"

Result2:

MessageReceiver:96 - Message received: {"name":"screenView","screenName":"homeScreen","previous":{"name":"screenView","screenName":"assetcard"

Labels (1)
0 Karma

Gr0und_Z3r0
Contributor

Hi @frodelauka 

One way to do it based on the events you shared is as below.

| makeresults 
| eval log="MessageReceiver:96 - Message received: {\"name\":\"screenView\",\"screenName\":\"assetcard\",\"previous\":{\"name\":\"screenView\",\"screenName\":\"homeScreen\",\"subscreenName\":\"STB.TOP.HOME\"\r\nMessageReceiver:96 - Message received: {\"name\":\"screenView\",\"screenName\":\"homeScreen\",\"previous\":{\"name\":\"screenView\",\"screenName\":\"assetcard\"" 
| makemv log delim="\r\n" 
| mvexpand log 
| eval check_msg_rxd=trim(replace(replace(mvindex(split(mvindex(split(log,",\"previous"),0),"received:"),-1),"\"",""),"\{",""))
|  where like(check_msg_rxd,"%assetcard")

 

If the reply helps, a Karma upvote would be appreciated.

0 Karma

frodelauka
Observer

I appreciate the feedback but as I'm just a Splunk rookie I do not understand the logic behind you query. Also, the makeresults function should be the first in the search so how would the entire search look like?

0 Karma

Gr0und_Z3r0
Contributor

Simplifying the way to approach it with a regex...

| rex field=_raw "Message received:\s\{(?P<check>.*?)\,\"previous"
| where like(check,"%assetcard%")



The idea is to get values before the word "previous" and check that string with the one you want to meet your search criteria.

0 Karma

frodelauka
Observer

I understand. Still, trying to run the search it returns no result...

index=example host=* message_name=* AND profileId="example" AND "deviceClass":"example" AND "Message received: {"name":"screenView","screenName":"assetcard""
| rex field=_raw "Message received:\s\{(?P<check>.*?)\,\"previous"
| where like(check,"%assetcard%")
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...