Splunk Search

How to edit my search to correlate values with a single index and invert results?

grimlock
Path Finder

I have a list of pids, parent pids and hostnames that I am trying to reduce to pids without parent pids by hostname.

Example of source data set

PID       PPID     hostname
4         0        test1
445       4        test1
4442      445      test1
660       16       test1

A simplified version of the massive index that I have so far, the required output would result in the following dataset:

PID       PPID     hostname
4         0        test1
660       16       test1

I have tried the following searches:
index=process NOT | join pid as ppid [ index=process | search ppid ]
eval searches and conditionals
multisearch versions of the same

Any assistance would be greatly appreciated.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try (only keep the events where ppid is not available as pid for same host.

index=process | table pid ppid hostname | eventstats values(pid) as pids by hostname | where isnull(mvfind(pids,ppid))

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Give this a try (only keep the events where ppid is not available as pid for same host.

index=process | table pid ppid hostname | eventstats values(pid) as pids by hostname | where isnull(mvfind(pids,ppid))

grimlock
Path Finder

Works PERFECTLY! Thanks a lot.

To avoid being inundated with pids field I simply modified this search to:

index=process | table pid ppid hostname | eventstats values(pid) as pids by hostname | where isnull(mvfind(pids,ppid)) | fields - pids

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

You want all records where the PPID does not appear as a PID

"the same search" NOT ["the same search" | rename PID as PPID | table PPID] |
0 Karma

grimlock
Path Finder

This answer is also functional but eventstats permits avoidance of subsearch. For small data sets this is a more efficient solution. I will have to be aware of overreaching my subsearch limit. If i had more points, I would award them here.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...