Splunk Search

how can i exclude the results of table B from table A ?

gts_ame_tfo_cty
New Member

Here is my query:

index="backup_script"  conf_brand=ios OR conf_brand=nxos
| rex field=conf_hostname "(?P^[^.]+)"
| eval status = "Device not sending logs to splunk"
| table hostname status
| dedup hostname | where like(hostname,"%"+"-rt-wan"+"%")
     | join  hostname [ search index="backup_script"  conf_brand=ios OR conf_brand=nxos 
     | rex field=conf_hostname "(?P<host>^[^.]+)" 
     | stats count by  host 
     | eval backup_hostname=host+"*"
     | table backup_hostname
     | where like(backup_hostname,"%"+"mon-rt-"+"%")
     | map [ search eventtype=cisco_ios host=$backup_hostname$ 
                    | eval final_hostname = $backup_hostname$
                    | rex field=final_hostname "(?P<hostname>^[^*]+)"
                    | table hostname 
                    | dedup hostname ] maxsearches=1000] 

Table A
host
A
B
C
D
E

table B
host
A
D
E

result
Host
B
C

Tags (1)
0 Karma

anjambha
Communicator

Hello,

You can try something like this :

<first table query> | table host status | join type=outer host [search <second table query>| rex field=host (?<host2>.*) | table host, host2] |fillnull value="NULL" host2 | where host2="NULL"
0 Karma

gts_ame_tfo_cty
New Member

I downvoted this post because not working

0 Karma

niketn
Legend

@gts_ame_tfo_cty, down voting on Splunk Answers community not same as other communities. Here we want more participations/heathy discussions rather than down voting, unless the information is misleading or harmful for your Splunk instance. Refer to Splunk Answers guidelines for the same.

Kindly consider the fact that Community Splunk Experts are trying to help you out with their Splunk experience alone without having access to your Splunk System and Data and sometimes even without having access to any Splunk instance at all.

Having said these can I also request you to re-post your current searches for Table A and Table B, with the code button 101010 in the Comment Box on Splunk Answers. Since you have some special characters in your code your SPL is not getting posted correctly.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

anjambha
Communicator

hey ts_ame_tfo_cty ,

If your second table contain one more column with proper value then you can try above query.

0 Karma

gts_ame_tfo_cty
New Member

Thank you for you answer but it's not workin 😞

index="backup_script"  conf_brand=ios OR conf_brand=nxos
| rex field=conf_hostname "(?P^[^.]+)"
| eval status = "Device not sending logs to splunk"
| table hostname status
| dedup hostname | where like(hostname,"%"+"tor-rt-"+"%")
     | join type=outer hostname [ search index="backup_script"  conf_brand=ios OR conf_brand=nxos 
     | rex field=conf_hostname "(?P<host>^[^.]+)" 
     | stats count by  host 
     | eval backup_hostname=host+"*"
     | table backup_hostname
     | where like(backup_hostname,"%"+"tor-rt-"+"%")
     | map [ search eventtype=cisco_ios host=$backup_hostname$ 
                    | eval final_hostname = $backup_hostname$
                    | rex field=final_hostname "(?P<hostname>^[^*]+)"
                    | table hostname 
                    | dedup hostname ] maxsearches=1000]  
                    |fillnull value="NULL" status | where status="NULL"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...