I have a set of field values 101,102,103,104,105
Here are sample log events
datetime, val=101
datetime, val=105
datetime, val=103
datetime, val=101
datetime, val=103
datetime, val=105
datetime, val=101
How can I count the number of field values not present?
102
and 104
are would not be found from the previous list; 2 field values not found.
@crisjnelson, refer to answer by @somesoni2 https://answers.splunk.com/answers/612603/how-to-search-what-values-are-missing-in-my-lookup.html
Add | eval data_source="lookup"
to the first search that you have to return all values i.e. 101, 102... 105. Then Add | eval data_source="index"
to the second search which may or may not return all the values. Finally perform a stats to keep source as a multi-valued field to perform filter based on whether data is present or not.
Following is run any where search based on data similar to the one in the question. Please replace with your first and second search instead of | makeresult ... | mvexpand
| makeresults
| eval val="101,102,103,104,105"
| makemv val delim=","
| mvexpand val
| eval data_source="lookup"
| append [| makeresults
| eval val="101,102,101,103,102,101,101,101,102,103"
| makemv val delim=","
| mvexpand val
| eval data_source="index"]
| stats count values(data_source) as data_source by val
| search data_source="lookup" AND data_source!="index"
| stats count
Wow, that's pretty interesting. Thanks!
@crisjnelson, refer to answer by @somesoni2 https://answers.splunk.com/answers/612603/how-to-search-what-values-are-missing-in-my-lookup.html
Add | eval data_source="lookup"
to the first search that you have to return all values i.e. 101, 102... 105. Then Add | eval data_source="index"
to the second search which may or may not return all the values. Finally perform a stats to keep source as a multi-valued field to perform filter based on whether data is present or not.
Following is run any where search based on data similar to the one in the question. Please replace with your first and second search instead of | makeresult ... | mvexpand
| makeresults
| eval val="101,102,103,104,105"
| makemv val delim=","
| mvexpand val
| eval data_source="lookup"
| append [| makeresults
| eval val="101,102,101,103,102,101,101,101,102,103"
| makemv val delim=","
| mvexpand val
| eval data_source="index"]
| stats count values(data_source) as data_source by val
| search data_source="lookup" AND data_source!="index"
| stats count