Answer by warren for Splunk regex filter events only one occurrence of special character

@Jerry‘s response is interesting – I would do something similar:

index="association" sourcetype="escaplogs" 
| rex field=data.val max_match=0 "(?<slashes>\/)"
| where isnotnull(slashes) AND mvcount(slashes)<2
<rest of search>

This is going to find everything that a) has at least one slash (isnotnull(slashes)) in the field data.val, and b) throwout everything with more than 1 (mvcount(slashes)<2)

from User warren – Stack Overflow https://stackoverflow.com/questions/76996036/splunk-regex-filter-events-only-one-occurrence-of-special-character/77000918#77000918
via IFTTT