Splunk Search

Search results that do not contain a word

mtxpert
Engager

I tried for an hour but couldn't find the answer. I need to search my syslogs from a specific host for entries that do not contain the word Interface my current search line is:

sourcetype="cisco_syslog" host="10.10.10.10"

I tried

sourcetype="cisco_syslog" host="10.10.10.10" | regex _raw(=|!=) [\ )?Interface(\] 

but it doesn't work.

I'm sure I'm close but I am terrible at regular expressions.

Tags (2)

gkanapathy
Splunk Employee
Splunk Employee
sourcetype="cisco_syslog" host="10.10.10.10" NOT "interface"

http://www.splunk.com/base/Documentation/latest/User/StartSearching#Add_Boolean_expressions

Get Updates on the Splunk Community!

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...