Splunk Search

Syntax for subsearches for using NOT function btw 2 savedsearches

pradeep0802
New Member

Hi Guys,

I have here 2 savedsearches, now i want to do a left outer join between both of them.
I'm using the following query:
| savedsearch "saved1" NOT [| savedsearch "saved2" | dedup accid | fields accid]

There seems to be a problem with the syntax.
Or is it not possible to use it with SavedSearch??

Please Help.
Thanks!!

Tags (2)
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

I get around the limitation of |search NOT [subsearch] by putting the NOT in the subsearch.

|savedsearch "saved1" [|savedsearch "saved2" | dedup accid| fields accid|format "NOT (" "(" "" ")" "OR" ")" ]

This forces the query returned to use the NOT.

0 Karma

pradeep0802
New Member

|savedsearch "saved1" [|savedsearch "saved2" | dedup accid| fields accid|format "NOT (" "(" "" ")" "OR" ")" ]

doesn't return anything
But,
|savedsearch "saved1" | search NOT [|savedsearch "saved2" | dedup accid| fields accid|format "NOT (" "(" "" ")" "OR" ")" ]

gives matching rows from both savedsearches.

but we need other unmatched rows from saved1.

any suggestion..? or any other way we can achieve this.

0 Karma

Ayn
Legend

The subsearch's results will be expanded to something like

((accid="accid1") OR (accid="accid2") OR ... )

Which is incorrect syntax for the subsearch command. You probably want to use it with the search command.

| savedsearch "saved1" | search NOT [| savedsearch "saved2" | dedup accid | fields accid]
0 Karma

pradeep0802
New Member

if i use
| search NOT
the resulted output is wrong

o\p saved1 is 20 rows and saved2 is 14 rows, there are 12 rows common in both. what we need is 8 rows from saved1 that are not present in saved2.. But using | search NOT gives result similar to outer join. ie 20 rows of saved1

what we are trying to achieve is similar to NOT IN clause in sql.

Any suggestion where we be going wrong..

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...