Splunk Search

How to search for a string that begins with a square bracket ]?

spadler
Explorer

I have a field value like this that I want to exclude.

 

[22minfo[3: host.console[0]

 

The searches I can think of either don't do anything or return an error. Note, I am trying to speed up a search so I do not want to use regex. 

Searches I tried:

 

 

message != [*
message != "["*
message != "[*"
message != '[*'
message != '['*

 

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I'm wondering if there's a "hidden" ESC character before the [ that keeps your searches from matching.  Try this regex command to see if it helps.  I understand you prefer to not use regex, but if nothing else works then why not?

| regex message!="^\x1b\["
---
If this reply helps you, Karma would be appreciated.

spadler
Explorer

It's my understanding that regex doesn't speed up searches. Is that right? Because the values that start with [ are not relevant to me and take up over half the results. They are being filtered out by other regex expressions, so I don't mind them being in the results except for the impact they have on speed. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It understood the OP as looking for ways to filter out certain events, but now you say they're already filtered.  So is the goal a "faster" way to do the filtering?  If so, have you looked at the Job Inspector to see how much time is spent doing regex?  It's probably not much compared to other parts of the job.

If there indeed is an ESC character before the [ then the only non-regex way to find it will be message != "*[*", but that will find a lot of false positives so is not useful.

---
If this reply helps you, Karma would be appreciated.

spadler
Explorer

Yes I think you're right. Using regex seems to be about as fast as doing something similar with the 'search' command or the 'where' command. I was confused about what order things should be done in for optimization. I also found the info on Parallel processing on this page useful. Thanks for your input. 

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...