Splunk Search

splunk query with specific product id count

freephoneid
Path Finder

Hi,

My log contains below entries:

activated=true productid=8432 userid=123 email=abc@abc.com
activated=false productid=8432 userid=2123 email=12@a212bc.com
activated=true productid=3422 userid=434123 email=pqe@dfd.com
activated=true productid=433232 userid=7468 email=434@a43433c.com

I want to find the count for all those users who have activated=true and whose productids are not 645,423,433232,7483,57893,45673,847832,48832,4323,432,3323,323,12,233,234545,2323

Can any one provide me the query for the same?

Thanks

Tags (3)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee
activated=true NOT productid=645 NOT productid=423 NOT productid=433232 NOT productid=7483 ... | stats count

View solution in original post

0 Karma

gooza
Communicator

use lookup tables , list the product id you're looking for in csv and add a seen field to it:

productid,seen

645,1

423,1
and so on

then run the search

activated=true | lookup yourlookuptable productid OUTPUT seen | Where seen!=1

you can read more on lookup tables at:

docs.splunk.com

0 Karma

gkanapathy
Splunk Employee
Splunk Employee
activated=true NOT productid=645 NOT productid=423 NOT productid=433232 NOT productid=7483 ... | stats count
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

if you look at gooza's answer, you can do it with a lookup table. it's actually better (much better) with a subsearch and a lookup definedd like he has, and then doing:

activated=true NOT [ inputlookup yourlookuptable | return 10000 productid ] | stats count

which will work with up to 10000 productids.

0 Karma

freephoneid
Path Finder

Hi gkanapathy....The product id list is more than 30...Is there another way to implement this query?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...