Splunk Search

How do you do disjunction of two sets in join condition

arungeorge09
Path Finder

I have a common field and 2 joins and want to work on the data which does not fall in the join condition.

Tags (1)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Have a look at Splunk's "set" command with diff option.
http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/Set

An example syntax would be

| set diff [Your first search  | table commonField] [Your second search  | table commonField] 
0 Karma

arungeorge09
Path Finder

Can someone please answer . I am looking for a minus query.

0 Karma

arungeorge09
Path Finder

I have 2 searches with a join condition txId . But I know that the second subsearch does not have same items. I want it as raw events. I tried the following

index=xyz event="NEAT-IN" platform=apns | eval txId=alertId |join txId [search index=xyz event=pushApns] | where isnull(txId)

Why this does not work. I got 0 events. This is not correct. There are less events in second subsearch based on stats.

I have a dashboard to prepare and really appreciate the help.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

By default, output of the join command is "inner join" and thus its just returning (if any) matching rows. So you'll not get any events with the isnull filter.

Try this to get all the non-matching rows from First search.

index=xyz event="NEAT-IN" platform=apns | eval txId=alertId |join type=left txId [search index=xyz event=pushApns] | where isnull(txId)
0 Karma

arungeorge09
Path Finder

@somesoni2 . The query works but it gives me zero results.
I have 578 distinct count(alertId) in first search
I have 488 distinct count(txId) in second search

I still don't understand why I will get 0 results.

Note: It should be isnull(alertId) because alertId is on the right table.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...