Getting Data In

How can I filter my search for a field only if the result is not a number?

bradmeg128
Engager

I am trying to filter my search for a field only if the result is not a number

EG
Index=proxylogs where isnum(cs_user) - This gives me the results only if the cs_user field is a number, i want the opposite; to show me only the ones that are NOT a number

I have tried isStr but that still gives me the numerical answers as well. I have tried various combinations of NOT's but cannot seem to get it to display only the non-numericals.

Any help is greatly appreciated

V/r
-Brad

0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

For completion I would use the following perhaps:

index=proxylogs
| regex cs_user="\D+"

Where the regular expression \D refers to any non-numerical character and the plus means one or more occurrences.

Thanks,
J

niketn
Legend

Try the following:

 <YourBaseSearch>
| where !(isnum(cs_user))
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

somesoni2
SplunkTrust
SplunkTrust

So, you're saying this didn't work?

index=proxylog | where NOT isnum(cs_user)

Give this a try as well.

index=proxylog | regex cs_user!="^[\d\.,]+$"

woodcock
Esteemed Legend

You should be aware that all of these answers are throwing away events where field cs_user has no value at all (e.g. isnull(cw_user) ) which you might care about, or might not.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...