All Apps and Add-ons

how to implement minus query in splunk?

meenal901
Communicator

Hi,

I have a lookup file which contains names of all services. From my logs, i get the current active/failed services. I want to find out the services which did not generate the logs. From SQL, i can implement a minus query to find out the difference in lookup and actual logs.
How to do this in Splunk?
I have tried set diff, but it is not giving the expected output.

Thanks,
Meenal

Tags (2)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi meenal901

given your lookup table is like this:

my_name, my_description
foo_name, this is used for logging

get the entries from the lookup table first, filter it based on which host you are seeing in the system logs. Let's say your lookup table is called my_lookup.csv, the relevant logs have sourcetype my_systemlogs and that the field my_name exists in those log events. In that case, this search should get you going:

| inputlookup my_lookup.csv | search NOT [search sourcetype="my_systemlogs" | dedup my_name | fields my_name]

hope this helps or gets you starting to find the result you're looking for

cheers,

MuS

View solution in original post

adityapavan18
Contributor

May be you can try something like this(definetly not optimized solution but get does the job)

<search> | stats count by service | table service | append[|inputlookup allservices.csv|table service] | stats count by service | where count = 1

will provide all services for which logs are not generated.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi meenal901

given your lookup table is like this:

my_name, my_description
foo_name, this is used for logging

get the entries from the lookup table first, filter it based on which host you are seeing in the system logs. Let's say your lookup table is called my_lookup.csv, the relevant logs have sourcetype my_systemlogs and that the field my_name exists in those log events. In that case, this search should get you going:

| inputlookup my_lookup.csv | search NOT [search sourcetype="my_systemlogs" | dedup my_name | fields my_name]

hope this helps or gets you starting to find the result you're looking for

cheers,

MuS

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...