Splunk Search

Compare two searches and show differences

jpetrov
New Member

Hi All,

I'm trying to gain some visibility into whether scans are completing on all hosts, at the moment they are not and I would like to easily see which ones are not working properly. I want to have three panels. One showing all hosts, the next showing all hosts in which scans have finished, and the last showing the difference between the two, ie showing hosts in which scans did not complete. I have to two easy queries complete, but can't seem to get the last one working:
1. host=* | top host limit=1000 | chart count
2. host=* "Writing report to /var/log/openvas/reports/report.xml" | chart count ]

Basically I want to show query 1 minus the results from query 2, so that I can see the hostnames of the boxes that are not completing the scan. I've tried diff and sub-searches with no luck, however I may have the syntax wrong. Any help would be hugely appreciated.

Tags (2)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try using this (validate the queries, both should have same columns)

|set diff [search host=* | top host limit=1000 | chart count] [search  host=* "Writing report to /var/log/openvas/reports/report.xml" | chart count ]

Updated:

try this

host=* NOT [search host=* "Writing report to /var/log/openvas/reports/report.xml" | stats count by host | fields - count] | chart count

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try using this (validate the queries, both should have same columns)

|set diff [search host=* | top host limit=1000 | chart count] [search  host=* "Writing report to /var/log/openvas/reports/report.xml" | chart count ]

Updated:

try this

host=* NOT [search host=* "Writing report to /var/log/openvas/reports/report.xml" | stats count by host | fields - count] | chart count

jpetrov
New Member

I got it, just need to take off chart count

0 Karma

jpetrov
New Member

I added | top host limit=1000 | to just show the number of hosts and I am finally seeing the correct number. The only remaining issue is that I would like to see the hostnames listed out rather than just the count number, or at least be able to drill down from the count number to see the list of hosts.

Thanks again for the help!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

My bad, let me know if the updated answer worked (or didn't work).

0 Karma

jpetrov
New Member

Thanks for the fast reply somesoni2,
This is not exactly what I am looking for. I basically need this panel to show all hosts that do not have the string "Writing report to /var/log/openvas/reports/report.xml" anywhere on them within the search time. I have tried host=* NOT "Writing report to /var/log/openvas/reports/report.xml", however this still shows all hosts, it just excludes that string.

I'm guessing there has to be an easy way to do this, I just haven't found it yet 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...