Checkmk Quicksearch and Service search query

Hello everyone,

Is it possible to search for all services and ignore a particular service for all the hosts that belong to a particular group on the Checkmk web interface?
For example: I want to search all the hosts that have the string “sftp” and all its services except the services with the name “http_alive” and status is not OK.

For example:

I tried the service search and chose the folder or the service contact group and then for the service check tried to negate the string “http” by doing “!http” or “[^http]” and the set the service hard state state by un-checking the OK box but it doesn’t seem to work.

I also tried this on Quick search like this but this does not work as well:
h:sftp s:!http

Hi,

I’m not really getting what you’re looking after but can this search box help you at all?

Hi Daniel,

This is exactly what I am looking for. On the newer version, I see this option of negate where I can ignore a service while performing the search.
Can we achieve this in older versions like 1.2.6p15 (sorry about this but the customer is still using this older version) and then upgrade to latest version will happens soon.?
.

I’m actually not sure. I haven’t touched older versions of Check_MK in a while so I’m not aware of the capabilities they have.

Regarding your problem, I can see that you that you know that quicksearch uses REGEX in order to perform any search so that could be of some help but since you’re looking for specific hosts in specific folders I’m not sure if this comes in hand.

Can you post a screenshot of the search you’re doing and re-explain what you’re trying to accomplish? Maybe it becomes easier to understand.

With the Quick search, If I do h:sftp s:http_alive - It gives me a list of services which have the string http_alive on the host with the string “sftp”…

Now If I need to see all the services of the host with the string “sftp” but not the "service with “http_alive” string in it, then I am trying to do this using negative lookahead and it
h:sftp s:^(?!http_alive$).* or
h:sftp s:[^http_alive] or
h:sftp s:!sftp
None of the combinations seems to work

Hi @marco ,
I think I found the Werk that added that feature.

Take a look here:
https://checkmk.com/check_mk-werks.php?werk_id=3640&HTML=yes

That means that the negate feature was added in version 1.4.0i1. So you should better update/upgrade your Checkmk Installation asap.

Hi Norm,

Thanks for the update.