Splunk Search

help for displaying events that have collected in one index but never in other

jip31
Motivator

hi
I tried to find host from my csv file which have connected in one specific index but never in others
I have done the search below but its what i need because it just exclude events from others indexes
how to do this please??

 index="tutu*" 
| search NOT (index="toto*" OR index="tata*" OR index="titi*") 
    [| inputlookup host.csv 
    | table host] 
| dedup host 
| table host
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi jip31,
try something like this:

(index="tutu*" OR index="toto*" OR index="tata*" OR index="titi*") [| inputlookup host.csv | table host] 
| stats values(index) AS index count BY host
| eval check=if(index="tutu*","only toto","also others")
| search check="only toto"
| table host

Ciao.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi jip31,
try something like this:

(index="tutu*" OR index="toto*" OR index="tata*" OR index="titi*") [| inputlookup host.csv | table host] 
| stats values(index) AS index count BY host
| eval check=if(index="tutu*","only toto","also others")
| search check="only toto"
| table host

Ciao.
Giuseppe

0 Karma

jip31
Motivator

perfect thanks

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...