Splunk Search

splunk query with specific product id count

freephoneid
Path Finder

Hi,

My log contains below entries:

activated=true productid=8432 userid=123 email=abc@abc.com
activated=false productid=8432 userid=2123 email=12@a212bc.com
activated=true productid=3422 userid=434123 email=pqe@dfd.com
activated=true productid=433232 userid=7468 email=434@a43433c.com

I want to find the count for all those users who have activated=true and whose productids are not 645,423,433232,7483,57893,45673,847832,48832,4323,432,3323,323,12,233,234545,2323

Can any one provide me the query for the same?

Thanks

Tags (3)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee
activated=true NOT productid=645 NOT productid=423 NOT productid=433232 NOT productid=7483 ... | stats count

View solution in original post

0 Karma

gooza
Communicator

use lookup tables , list the product id you're looking for in csv and add a seen field to it:

productid,seen

645,1

423,1
and so on

then run the search

activated=true | lookup yourlookuptable productid OUTPUT seen | Where seen!=1

you can read more on lookup tables at:

docs.splunk.com

0 Karma

gkanapathy
Splunk Employee
Splunk Employee
activated=true NOT productid=645 NOT productid=423 NOT productid=433232 NOT productid=7483 ... | stats count
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

if you look at gooza's answer, you can do it with a lookup table. it's actually better (much better) with a subsearch and a lookup definedd like he has, and then doing:

activated=true NOT [ inputlookup yourlookuptable | return 10000 productid ] | stats count

which will work with up to 10000 productids.

0 Karma

freephoneid
Path Finder

Hi gkanapathy....The product id list is more than 30...Is there another way to implement this query?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...