1

I've been trying to search logs in Sumo that do not contain a pattern like this one: "id=a*". This looks pretty simple but I have several attempts and nothing yet.

Tried doing ... and not "id=a": This doesn't work because this never is the case, logs come like id=a123 for example.

Also with ... and not "id=a*": here Sumo doesn't use * as a wildcard so it doesn't work either.

Tried with ... and not id=a*" This one doesn't work at all, because = needs to be escaped.

Tried with: ... and not id%"="a* this one doesn't yield the correct results. TheI grabbed %"=" from https://help.sumologic.com/05Search/Get-Started-with-Search/Search-Basics/Reference_a_Field_with_Special_Characters

I just want to make sure something like this gets selected: id=a123 but not something like this id=z123.

Nicolas Jimenez
  • 55
  • 5

1 Answers1

1

I was able to do it with:

....
| parse "id=*}" as id
| where id matches /^(?!a).+/

By doing this we isolate blabla from id=blabla} and then with regex just check that the string doesn't start with a.

Nicolas Jimenez
  • 55
  • 5