Splunk Search

Why using regex to remove a particular field is not working?

praddasg
Path Finder

I am using the below query and I was able to not get the results which had messages like "Optional.of(The following items are not available for order at this time)" but I found one of the message still appearing "Optional.of(Items quantity is over the maximum quantity)". Not sure if this has anything to do with the regex

REJECTED sourcetype="pos-generic:prod" partner_account_name="Level Up"
| regex message != "item"
| table merchantId, orderId, message
| stats count by merchantId, message

alt text

Tags (1)
0 Karma
1 Solution

vnravikumar
Champion

Hi

Try with following where instead of regex

......| where NOT message like ("%item%") AND NOT message like ("%Item%")|...

View solution in original post

mydog8it
Builder

If you would like to stay with regex I think this will get it for you:

| regex message != "[iI]tem"

vnravikumar
Champion

Hi

Try with following where instead of regex

......| where NOT message like ("%item%") AND NOT message like ("%Item%")|...
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...