Search code examples
regexsplunksplunk-querysplunk-dashboard

Splunk query not endswith

I am just into learning of Splunk queries, I'm trying to grab a data from myfile.csv file based on the regex expression.

In particular, I'm looking forward, print only the rows where column fqdn not endswith udc.net and htc.com.

Below is my query which is working but i'm writing it twice.

| inputlookup myfile.csv 
| regex support_group="^mygroup-Linux$" 
| regex u_sec_dom="^Normal Secure$" 
| regex fqdn!=".*?udc.net$"
| regex fqdn!=".*?htc.com$"
| where match(fqdn,".")

I am trying them to combine with | separeted but not working though...

   | regex fqdn!="(.*?udc.net | ".*?htc.com)$"
Solution

  • You can do this with a search and where clause:

    | inputlookup myfile.csv 
| search support_group="mygroup-Linux" u_sec_dom="Normal Secure"
| where !match(fqdn,"udc.net$") AND !match(fqdn,"htc.com$")

    Or just a single search clause:

    | inputlookup myfile.csv
| search support_group="mygroup-Linux" u_sec_dom="Normal Secure" NOT (fqdn IN("*udc.net","*htc.com")

    You can also rewrite the IN() thusly:

    (fqdn="*udc.net" OR fqdn="*htc.com")