Getting Data In

Display sources which do not have a string

nbk7e9d
New Member

Hello,

When I restart a large application with hundreds of processes, I can see a string like "startup successful" from the logs.

How can I display a list of host and sources which do not have this string?

host1:/a/b/c1/file1.log
host1:/a/b/c2/file2.log
host1:/a/b/c3/file3.log
host2:/a/b/c1/file1.log
host2:/a/b/c2/file2.log
host2:/a/b/c3/file3.log
...

Suppose host99:/a/b/c13/file23.log did not have the "startup successful" string. How would I display that?

Tags (3)
0 Karma

kristian_kolb
Ultra Champion

Proving the negative is a bit harder than opposite. Assuming that all of those files are of the same sourcetype, one approach is to use a simple subsearch;

sourcetype=XXX earliest=-15m NOT [search sourcetype=XXX earliest=-15m "startup successful" | dedup host, source | fields + host, source] | dedup host, source | table host, source

Set the earliest time at the time of the restart, so you don't get irrelevant older events included. In this case I gave the application 15 minutes to startup, before running the search so-to-speak.

/K

nbk7e9d
New Member

The double negative type question is confusing me. 🙂 This search will give me a table of hosts,logs that do NOT have "start successful" message from the time I choose in the TimePicker.

0 Karma

HiroshiSatoh
Champion

Is not output to the list if any (host log is not output) host has not been activated within the specified time that it is the search is present but OK?

0 Karma

nbk7e9d
New Member

Since I'm selecting a custom time from the timepicker and my sourcetypes aren't exactly the same, I used:

host=host* sourcetype=logs* NOT [search host=host* sourcetype=logs* "startup successful" | dedup host, source | fields + host, source] | dedup host, source | table host, source

This works nicely. Thanks!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...