topic Re: Find unique events in one search and NOT the other in Splunk Search

Find unique events in one search and NOT the other

Joe20 — Sun, 21 Feb 2021 03:31:57 GMT

I have events with two keys area and errortext. Sample event below:

[2021-02-20 19:27:37.599 GMT] ERROR Servlet|test-event| element=PlaceOrder,routine=start,receiptNumber=000006,errortext="Initiating ReversePayments for Order, Reason: Inventory reservation failed"

I need to find :

1. unique events that match element and errortext values for a time window -1

2. find the same unique events for a time window-2 then

3. find events that are present in time window-1 and NOT in time window-2

To find unique events in time-window-1 --I am using the below query.

index=dev sourcetype!=warn element AND errortext earliest=@w5 latest=+7d@w6 | dedup element,errortext | table element,errortext

I am trying to use search and NOT but not able do so in this case.

SearchOne NOT [ SearchTwo ]

Re: Find unique events in one search and NOT the other

tscroggins — Sun, 21 Feb 2021 05:07:40 GMT

@Joe20

Using an example time window of 24 hours, try:

element=* errortext=* earliest=-24h latest=now NOT [ element=* errortext=* earliest=-48h latest=-24h | table element errortext ]

This will return events over the last 24 hours with key field combinations (element AND errortext) that were not present between 48 and 24 hours ago.

You may want to review timestamp extractions and time zone offsets if you frequently need to search for future times, e.g. +7d@w6, and those future times are not be design.

Re: Find unique events in one search and NOT the other

Joe20 — Mon, 22 Feb 2021 02:02:45 GMT

This worked. Thank you very much @tscroggins