Splunk Search

Is there a way to do a NOT IN search

riotto
Path Finder

something like;

[search index= myindex source=server.log earliest=-360 latest=-60 "

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try like this

index="idx" source="server.log" earliest=-360 latest=-60 "<Request" | xmlkv | fields clientId | search NOT
 [search  index="idx" source="server.log" earliest=-360 latest=now "<Response" | xmlkv | stats count by clientId |table clientId]

View solution in original post

0 Karma

malvidin
Communicator

I would recommend using an eventstats command to exclude 

index="idx" earliest=-360s latest=-0s source="server.log"  "<Request" 
| xmlkv 
| eventstats earliest_time(clientId) as earliest_clientId by clientId
| where relative_time(now(), "-60s") > earliest_clientId
|`enter code here`

 

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this

index="idx" source="server.log" earliest=-360 latest=-60 "<Request" | xmlkv | fields clientId | search NOT
 [search  index="idx" source="server.log" earliest=-360 latest=now "<Response" | xmlkv | stats count by clientId |table clientId]
0 Karma

riotto
Path Finder

it works! Thanks much

0 Karma

cmerriman
Super Champion

are you trying to search for everything EXCEPT search index= myindex source=server.log earliest=-360 latest=-60

riotto
Path Finder

No, something like
earliest=-360 latest=-60 "

0 Karma

riotto
Path Finder

can't paste my example?

0 Karma

riotto
Path Finder

it's cutting off my example sorry

0 Karma

cmerriman
Super Champion

when pasting your example, highlight the syntax and click on the little '101 010' icon above the texbox

riotto
Path Finder
[search index="idx" source="server.log" earliest=-360 latest=-60 "<Request" | xmlkv | fields clientId]
NOT IN
[search  index="idx" source="server.log" earliest=-360 latest=now "<Response" | xmlkv | fields clientId]`enter code here`
0 Karma

ppablo
Retired

@riotto

Can you give more details on what you're looking for with expected results? It's hard just figuring this out with only a search. People need more context here other than the same search you put in the content of your question.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...