- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Subsearch 2 fields with Match and 1 mismatch
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Subsearch 2 fields with Match and 1 mismatch
index =ttt beforeController [search index = ttt beforeController | fields pnr, bnr, NOT(gnr)]
How can I achieve that? I am trying to subsearch same types of transactions where 2 fields needs to match exactly(pnr, bnr) but 3 one should not match(gnr).
Example:
Suppose there are 3 transactions:
1. http://cdn.xxx.yy.com/pnr=PAA&bnr=BAA&gnr=GAA&class=A]
2. http://cdn.xxx.yy.com/pnr=PAA&bnr=BAA&gnr=GAA&class=B]
3. http://cdn.xxx.yy.com/pnr=PAA&bnr=BAA&gnr=GAA2&class=c]
So here I want the transactions matching 1 and 3 or 2 and 3, where pnr and bnr should match but not gnr.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Why not just use dedup command with all three fields so that any duplicates will be removed.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I still don't understand you. You want events 1 & 3, but 1 &2 are identical in your example
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
so basically I don't want duplicates, so you can say (1 and 3) or (2 and 3).
Not to mention timestamp for these 3 events are different.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I assume you mean you have three fields, pnr, bnr, and gnr. You want to find events where gnr is null.
index=ttt beforeController pnr=* bnr=* | where isnull(gnr)
If that's not what you're trying to do can you provide som sample events and an example of what you want the result to be?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have updated the question with example. Let me know if that helps in understanding it better.
Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...
Splunk APM: New Product Features + Community Office Hours Recap!
Index This | Forward, I’m heavy; backward, I’m not. What am I?
