https://community.splunk.com/t5/Splunk-Enterprise-Security/Comparing-results-from-two-searches/m-p/468113#M7046 <P>index="A" sourcetype=B action=Yes<BR /><BR /> | search NOT [ search index="A" sourcetype=B action="No" | fields User ] | stats count by User .</P> <P>Here I'm trying to get user whose action is Yes. But whenever users get 'Yes' they get 'No' as well in 20% of cases at same time.<BR /> So I want those 80% users who are having action as only Yes.</P> <P>Could you please help.</P> Wed, 04 Sep 2019 13:37:35 GMT rupeshn 2019-09-04T13:37:35Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Comparing-results-from-two-searches/m-p/468113#M7046 <P>index="A" sourcetype=B action=Yes<BR /><BR /> | search NOT [ search index="A" sourcetype=B action="No" | fields User ] | stats count by User .</P> <P>Here I'm trying to get user whose action is Yes. But whenever users get 'Yes' they get 'No' as well in 20% of cases at same time.<BR /> So I want those 80% users who are having action as only Yes.</P> <P>Could you please help.</P> Wed, 04 Sep 2019 13:37:35 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Comparing-results-from-two-searches/m-p/468113#M7046 rupeshn 2019-09-04T13:37:35Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Comparing-results-from-two-searches/m-p/468114#M7047 <P>When i run above query I'm getting results of both users i.e., action=Yes and action= No. I'mm not sure where this Query went wrong </P> Wed, 04 Sep 2019 13:39:22 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Comparing-results-from-two-searches/m-p/468114#M7047 rupeshn 2019-09-04T13:39:22Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Comparing-results-from-two-searches/m-p/468115#M7048 <P>Are you only going to have a single Yes and/or a single No for a user? So the most entries you would have for a single user is 2?</P> Wed, 04 Sep 2019 14:22:19 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Comparing-results-from-two-searches/m-p/468115#M7048 kmaron 2019-09-04T14:22:19Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Comparing-results-from-two-searches/m-p/468116#M7049 <P>So, you looking for users who only received one of the two actions?</P> <P>Using a subsearch has it's limits:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchTutorial/Useasubsearch">https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchTutorial/Useasubsearch</A></P> <P>You could accomplish something similar with the following:</P> <PRE><CODE>index="A" sourcetype=B action=Yes OR action=No | stats dc(action) as action_count by User | search action_count&lt;2 </CODE></PRE> Wed, 04 Sep 2019 14:36:53 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Comparing-results-from-two-searches/m-p/468116#M7049 solarboyz1 2019-09-04T14:36:53Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Comparing-results-from-two-searches/m-p/468117#M7050 <P>That would also give you the No people.</P> <P>But changing it to</P> <PRE><CODE> index="A" sourcetype=B action=Yes OR action=No | stats dc(action) as action_count values(action) as action by User | search action_count&lt;2 AND action=Yes </CODE></PRE> <P>Would be only Yes's. </P> Wed, 04 Sep 2019 14:39:59 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Comparing-results-from-two-searches/m-p/468117#M7050 kmaron 2019-09-04T14:39:59Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Comparing-results-from-two-searches/m-p/468118#M7051 <P>good catch!</P> Wed, 04 Sep 2019 14:46:17 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Comparing-results-from-two-searches/m-p/468118#M7051 solarboyz1 2019-09-04T14:46:17Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Comparing-results-from-two-searches/m-p/468119#M7052 <P>I've tried the query posted by you. But it still gives both the users.</P> Wed, 04 Sep 2019 15:24:09 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Comparing-results-from-two-searches/m-p/468119#M7052 rupeshn 2019-09-04T15:24:09Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Comparing-results-from-two-searches/m-p/468120#M7053 <P>@kmaron ,I've tried the query posted by you. But it still gives both the users.</P> Wed, 04 Sep 2019 15:25:09 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Comparing-results-from-two-searches/m-p/468120#M7053 rupeshn 2019-09-04T15:25:09Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Comparing-results-from-two-searches/m-p/468121#M7054 <P>I mean users with both actions.</P> Wed, 04 Sep 2019 15:42:52 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Comparing-results-from-two-searches/m-p/468121#M7054 rupeshn 2019-09-04T15:42:52Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Comparing-results-from-two-searches/m-p/468122#M7055 <P>please share the output you got</P> Wed, 04 Sep 2019 15:59:54 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Comparing-results-from-two-searches/m-p/468122#M7055 kmaron 2019-09-04T15:59:54Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Comparing-results-from-two-searches/m-p/468123#M7056 <P>Hi kmaron,</P> <P>I'm getting output but i believe the output that i'm getting is very less(less number of records) than what it should be. </P> Sat, 07 Sep 2019 17:10:18 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Comparing-results-from-two-searches/m-p/468123#M7056 rupeshn 2019-09-07T17:10:18Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Comparing-results-from-two-searches/m-p/468124#M7057 <P>If you think the results are incorrect, you can break the search down and review the data:</P> <PRE><CODE>index="A" sourcetype=B action=Yes OR action=No | stats dc(action) as action_count, values(action) as action, by User </CODE></PRE> <P>Will show all the results, you can sort by action_count, action, etc.. Look for anomalous values for action.</P> Mon, 09 Sep 2019 13:24:11 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Comparing-results-from-two-searches/m-p/468124#M7057 solarboyz1 2019-09-09T13:24:11Z