How do i optimize the following Splunk query?

Question

I have results like below:

 1. DateTime=2019-07-02T16:17:20,913 Thread=[],  Message=[Message(userId=124, timestamp=2019-07-02T16:17:10.859Z, notificationType=CREATE, userAccount=UserAccount(firstName=S, lastName=K, emailAddress=abc@xyz.com, status=ACTIVE), originalValues=OriginalValue(emailAddress=null)) Toggle : true]


 2. DateTime=2019-07-02T16:18:20,913 Thread=[],  Message=[Message(userId=124, timestamp=2019-07-02T16:17:10.859Z, notificationType=CREATE, userAccount=UserAccount(firstName=S, lastName=K, emailAddress=abc@xyz.com, status=ACTIVE), originalValues=OriginalValue(emailAddress=new@xyz.com)) Toggle : true]


 3. DateTime=2019-07-02T16:19:20,913 Thread=[],  Message=[Message(userId=124, timestamp=2019-07-02T16:17:10.859Z, notificationType=CREATE, userAccount=UserAccount(firstName=S, lastName=K, emailAddress=abc@xyz.com, status=ACTIVE), originalValues=OriginalValue(emailAddress=new@xyz.com)) Toggle : true]

And I am trying to group results where the contents of the entire "Message" field is same and "emailAddress=null" is not contained in the Message.

So in the results above 2 and 3 should be the output.

The following query works fine for me but I need to optimize it further according to the following conditions:

Working Query : index=app sourcetype=appname host=appname* splunk_server_group=us-east-2 | fields Message | search Message= "[Message*" | regex _raw!="emailAddress=null" | stats count(Message) as count by Message | where count > 1 index=app sourcetype=appname host=appname* splunk_server_group=us-east-2 | fields Message | search Message= "[Message*" | regex _raw!="emailAddress=null" | stats count(Message) as count by Message | where count > 1

Conditions to optimize

• Cannot rex against raw
• Message key/value pair needs to be in the main search, not a sub-search

Answer 1

You don't have any subsearches in your current query. A subsearch is a query surrounded by square brackets.

What's wrong with rex against _raw?

Try this:

index=app sourcetype=appname host=appname* splunk_server_group=us-east-2 Message="[Message*" 
| fields Message 
| regex Message!="emailAddress=null" 
| stats count(Message) as count by Message | where count > 1