Splunk Search

Can you help me with a search which only shows results that do not contain a specific value?

JoshuaJohn
Contributor

I want to see devices that do not have a specific value. I am organizing my devices by Mac Address, and I am trying to see the ones that do not have a profile named WifiProfile_X.

I keep getting the ones that do contain this profile, but I need to see the ones that dont.. any ideas?

index=nitro_apps source="DATA" | rex "^[^,\n]*,(?P<OG>[^,]+)[^,\n]*,(?P<MacAddress>[^,]+)(?:[^ \n]* ){4}(?P<Model>[^,]+),(?P<OS>[^,]+),\w+,(?P<Profile>[^,]+),\d+,(?P<Latest_Version>\d+),(?P<Installed_Date>[^,]+)[^,\n]*,(?P<Installed>\w+)"  | search OG=7 AND Model=180 AND Profile NOT "WifiProfile_X"
|stats list(MacAddress), list(Model), dc(MacAddress)
0 Karma

JoshuaJohn
Contributor

It was my regex... figured it out, thanks!

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

@joshuajohn

i'm glad you figured out the problem for yourself. Would you mind describing how you were able to fix your regex so that future users could learn from your process? Thanks.

0 Karma

Vijeta
Influencer

Hi,

Try using this search-

search OG=7 AND Model=180 AND Profile != "WifiProfile_X"

Thanks

0 Karma

JoshuaJohn
Contributor

Unfortunately no, this gives me every device in that location regardless of each devices settings.

0 Karma

Vijeta
Influencer

Do you want to list count of all distinct Mac address and also list all models and MacAddress by Profile? What does device settings refer to?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...