topic Re: Subsearch: How can we only see results when they are NOT found? in Splunk Search

Subsearch: How can we only see results when they are NOT found?

mattheuslima — Mon, 23 Mar 2020 19:11:11 GMT

I running a subsearch where i use a ID to find events from the index B in the index A.

What I want to do is: list the ID's from the index B that was not found in the index A

The subsearch structure is : search index=A search index=B |table ID's

How can I list the ID's that wasn't found?

manjunathmeti — Mon, 23 Mar 2020 19:29:26 GMT

You need to use NOT.

index=A NOT [search index=B | table ID's]

woodcock — Mon, 23 Mar 2020 19:46:10 GMT

Skip the subsearch and do this:

index="A" OR index="B"
| stats dc(index) AS indexCount values(index) AS index BY ID
| where index="B" AND indexCount=1