How do you search for event types that return no results?

[JordanPeterson]

I have a list of event types I'm searching for based on a standard naming convention. I want to be able to return a list of event types that have not occurred in the given time frame. Right now, my search looks something like this:

eventtype=ps-*

And then from there, I am working with the list of returned events. I need a separate search to get a list of the event types that didn't return anything.

Thoughts?

[DalJeanis · Accepted solution]

Try something like....

  eventtype=ps-* 
  | fields eventtype
  | dedup eventtype 
  | eval status="foundme" 
  | append [ 
     | rest servicesNS/-/-/saved/eventtypes
     | table title
     | eval status="notfound" ]
  | dedup eventtype
  | where eventtype="notfound"

[JordanPeterson]

This is very close to what I needed. Yours had a few syntax differences from what I needed but I used it as the baseline for this:

eventtype=PS-* 
| dedup eventtype 
| eval found="TRUE" 
| table eventtype found 
| append 
    [| rest servicesNS/-/-/saved/eventtypes 
    | search title=PS-* 
    | eval found="FALSE" 
    | rename title AS eventtype 
    | table eventtype found] 
| sort -found 
| dedup eventtype 
| where found="FALSE"
| table eventtype

[DalJeanis]

Since the FALSE values in the append come after the TRUE values, the sort is unnecessary work for the CPU, but that's a nit. Glad it worked for you.

By the way, change your sort to this...

| sort 0 - found

1) Sort in splunk is an odd duck. Unlike any other language, sort defaults to only return the first 10K results. So get in the habit of telling it to give you all results via sort 0, even if you are expecting fewer results than that.

2) As a matter of form, get in the habit of leaving a space between the minus and the field name. There are some splunk search commands that will allow them to be together like that, and some that won't, and better to make it visually obvious that the minus is an operator.

---

An alternative after the append that gets the same result might be...

 | stats count by eventtype 
 | where count=2
 | table eventtype

There's no particular efficiency reason to prefer one over the other, but this one might be more obvious to most beginners than the dedup version is.

[adonio]

use this search to find all eventtypes:

|rest servicesNS/-/-/saved/eventtypes
| table title

now you can go however you want, lookup and find with lookup command, sub search or other methods to find out which eventtypes are not captured