CODEWITHSUNDEEP
splunksplunk-query
blue-sky
blue-sky

Reputation: 53896

Splunk query for matching lines that do not contain text

To find logging lines that contain "gen-application" I use this search query : 

source="general-access.log" "*gen-application*"

How to amend the query such that lines that do not contain "gen-application" are returned ?

source="general-access.log" != "gen-application" returns error : 

Error in 'search' command: Unable to parse the search: Comparator '!=' has an invalid term on the left hand side:

Upvotes: 8

Views: 28101

Answers (1)

matthew-e-brown
matthew-e-brown

Reputation: 3087

I would use the NOT operator.

source="general-access.log" NOT "*gen-application"

Keep in mind that Splunk also has support for AND and OR.

Upvotes: 9

Related Questions