Hi Splunkers!
I've a doubt regarding searchmatch function, when I tried excluding some string using NOT boolean inside a searchmatch..it is not working fine although AND/OR Boolean is working fine..
Can't we use NOT while using searchmatch in query?
Below is my sample query:
index=xxx source=yyy "Issue-1111" OR "Issue-1122" OR "Failure-1212" OR "Failure-1111" OR "Failure-"
|eval Result=case(searchmatch("Issue-1111"), "Desc 1",
searchmatch("Issue-1122"), "Desc 2",
searchmatch("Failure-1212"), "Desc 3",
searchmatch("Failure-1111"), "Desc 4",
(searchmatch("Failure-") NOT searchmatch("Failure-1111") NOT searchmatch("Failure-1212") , "All Failures Excluding Desc3&4"))
|stats count by Result
Thanks in Advance!
NOT
is allowed in that use case, but must be accompanied by AND
or OR
. For example,
|eval Result=case(searchmatch("Issue-1111"), "Desc 1",
searchmatch("Issue-1122"), "Desc 2",
searchmatch("Failure-1212"), "Desc 3",
searchmatch("Failure-1111"), "Desc 4",
(searchmatch("Failure-") AND NOT searchmatch("Failure-1111") AND NOT searchmatch("Failure-1212") , "All Failures Excluding Desc3&4"))
NOT
is allowed in that use case, but must be accompanied by AND
or OR
. For example,
|eval Result=case(searchmatch("Issue-1111"), "Desc 1",
searchmatch("Issue-1122"), "Desc 2",
searchmatch("Failure-1212"), "Desc 3",
searchmatch("Failure-1111"), "Desc 4",
(searchmatch("Failure-") AND NOT searchmatch("Failure-1111") AND NOT searchmatch("Failure-1212") , "All Failures Excluding Desc3&4"))