Splunk Search

Exclude any transaction that doesn't include a specific value

marxsabandana
Path Finder

I need to filter searches that has a value of "F*" included per transaction number. The transaction number with my search will be composed of multiple product codes. Along with the values starting with "F".

A field name called "ProductCode" has values like: "F1, SH, VE, BB4521036, BB7895411"

| stats list(ProductCode) as ProductdCode by TransactionNumber

So, one event would look like this:

TransactionNumber | ProductCode

000532154 | F1
---------------- SH
---------------- VE
---------------- BB4521036
---------------- BB7895411

065212737 | CT
---------------- 12
---------------- SD
---------------- BB1125364
---------------- BB7885621

044568931 | F6
---------------- 08
---------------- JO
---------------- BB1125364
---------------- BB7885621

I only want to include transactions that includes ProductCodes starting with "F" while keeping the other ProductCodes intact. Thus, the 2nd event not having any product code starting with "F", should be excluded.

0 Karma

Sukisen1981
Champion
|eval first_val=mvindex(ProductCode,0)| where !LIKE(first_val, "F%")

Couple of points to keep in mind
list only returns the first 100 values , and more than that are you sure F ALWAYS occurs in the first row of the multivalued field?
For instance, can F6 occur after 08 OR JO in the ProductCode multivalued field?

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...