I have JSON records.
Some contain the field logdata.message, others contain the field logdata.exception.Message.
I wish to find all the records where logdata.exception.Message does not exist.
Note that both logdata and logdata.exception are parsed as objects containing fields (strings) or other objects.
I tried the approach suggested here (https://answers.splunk.com/answers/59305/how-to-find-records-that-do-not-contain-a-certain-field.htm...) but the following didn't work:
index=appdata level="ERROR" NOT 'logdata.exception'=* NOT 'logdata.exception.Message'=*
Since the fields have periods in their qualified names, I wrapped them in single quotes.
You must use double-quotes, not single-quotes. Try this:
index=appdata level="ERROR" NOT ("logdata.exception"="*" OR "logdata.exception.Message"="*")
You must use double-quotes, not single-quotes. Try this:
index=appdata level="ERROR" NOT ("logdata.exception"="*" OR "logdata.exception.Message"="*")
Why,if you need events "where logdata.exception.Message does not exist", you used both the conditions?
Bye.
Giuseppe
Try this
index=appdata level="ERROR" NOT ('logdata.exception'=* OR 'logdata.exception.Message'=*)
no go - I replaced the OR with AND as well. Neither worked. 😞
Does index=appdata level="ERROR"
return valid data?