Splunk Search

Negative substring matching against simple string

nicklbailey
New Member

First, I am completely new to Splunk and the extent of my expertise with the query language is dumb wildcard matching and boolean combinations. I'm more than happy to learn more, but you're going to have to explain it assuming minimal knowledge. More than happy to rtfm, if someone could point me to the part of the manual I should be reading (all of it is not a good answer).

So actual question:
I want to exclude all events where one of the fields contains a substring of the following form: "string-one":"string-two", where string-one and string-two are particular strings of interest. So for example I'd like to match

field: blah blah blah "foo":"bar"

But not

field: blah blah blah "string-one":"string-two"

As an additional note, this is only one filter in a long list of conditions in the query
I've tried a simple :
Field NOT ("*\string-one\":\"string-two\"*")

But it isn't working as I expect

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

There's an extra escape character in your search string. Try Field NOT ("*string-one\":\"string-two\"*") or Field NOT ('*string-one":"string-two"*'). If those fail, try ... | where NOT like(field, '%string-one":"string-two"%') | ....

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...