topic search command in Splunk Search

search command

uhkc777 — Thu, 25 Aug 2016 17:47:39 GMT

Here is my search query.

index=parmed-stage|eval _time=_time+14400|table _time OrderId OrderDetailID _raw|search NOT [|search index=sapecc-stage source=DBX:SAPECC-SE8 sourcetype=DBX:SAP-SalesOrder| table SALESORDERNUM ITEMDETAILID|rename SALESORDERNUM as OrderId, ITEMDETAILID as OrderDetailID] |table _raw OrderId OrderDetailID

I want to get the events from parmed which are not in sapecc index.
Here OrederID field in parmed matches SALESORDERNUM and OrderDetailID matches ITEMDETAILID. I want to get the events which don't match.

Re: search command

sundareshr — Thu, 25 Aug 2016 17:56:33 GMT

Try like this

index=parmed-stage NOT [search index=sapecc-stage source=DBX:SAPECC-SE8 sourcetype=DBX:SAP-SalesOrder| table SALESORDERNUM ITEMDETAILID|rename SALESORDERNUM as OrderId, ITEMDETAILID as OrderDetailID] | table _raw OrderId OrderDetailID

Re: search command

uhkc777 — Thu, 25 Aug 2016 18:02:52 GMT

No it's not working.It's just showing all events in parmed.(includes common events in sapecc which i don't want)

Re: search command

sundareshr — Thu, 25 Aug 2016 18:13:37 GMT

Click on Job >> Inspect Job and scroll down till you see litsearch (Ctrl+F litsearch on the popup window) and see if that search is correct. If not, let me know what that should be. This searches for NOT (OrderId="xyz" AND OrderDetailID="abc"). Do you want NOT (OrderId="xyz" OR OrderDetailID="abc")

Re: search command

uhkc777 — Thu, 25 Aug 2016 18:23:07 GMT

NOT (OrderId="xyz" AND OrderDetailID="abc")-----I want this one

Re: search command

uhkc777 — Thu, 25 Aug 2016 18:27:16 GMT

only those 2 field values matches in 2 indexes....remaining everything is different

Re: search command

sundareshr — Thu, 25 Aug 2016 18:28:18 GMT

What does litsearch show?

Re: search command

uhkc777 — Thu, 25 Aug 2016 18:34:42 GMT

check the attachment image in next answer for litsearch

Re: search command

uhkc777 — Thu, 25 Aug 2016 18:41:00 GMT

@Sundaresh

Re: search command

sundareshr — Thu, 25 Aug 2016 18:52:20 GMT

No attachment. Can you just copy paste the NOT () bit as text?

Re: search command

uhkc777 — Thu, 25 Aug 2016 18:58:41 GMT

@sundareshr
itsearch index=parmed-stage NOT ( ( OrderDetailID="10" AND OrderId="1000041934" ) OR ( OrderDetailID="90" AND OrderId="1000022259" ) OR ( OrderDetailID="80" AND OrderId="1000022259" ) OR ( OrderDetailID="70" AND OrderId="1000022259" ) OR ( OrderDetailID="60" AND OrderId="1000022259" ) OR ( OrderDetailID="50" AND OrderId="1000022259" ) OR ( OrderDetailID="40" AND OrderId="1000022259" ) OR ( OrderDetailID="30" AND OrderId="1000022259" ) OR ( OrderDetailID="20" AND OrderId="1000022259" ) OR ( OrderDetailID="10" AND OrderId="1000022259" ) OR ( OrderDetailID="10" AND OrderId="1000041933" ) OR ( OrderDetailID="10" AND OrderId="1000041932" ) OR ( OrderDetailID="10" AND OrderId="1000041911" ) OR ( OrderDetailID="40" AND OrderId="1000041100" ) OR ( OrderDetailID="50" AND OrderId="1000041100" ) OR ( OrderDetailID="60" AND OrderId="1000041100" ) OR ( OrderDetailID="30" AND OrderId="1000041100" ) OR ( OrderDetailID="20" AND OrderId="1000041100" ) OR ( OrderDetailID="10" AND OrderId="1000041100" ) OR ( OrderDetailID="10" AND OrderId="1000041055" ) OR ( OrderDetailID="40" AND OrderId="1000041046" ) OR ( OrderDetailID="30" AND OrderId="1000041046" ) OR ( OrderDetailID="20" AND OrderId="1000041046" ) OR ( OrderDetailID="10" AND OrderId="1000041046" ) OR ( OrderDetailID="10" AND OrderId="1000041045" ) OR ( OrderDetailID="40" AND OrderId="1000041045" ) OR ( OrderDetailID="30" AND OrderId="1000041045" ) OR ( OrderDetailID="20" AND OrderId="1000041045" ) OR ( OrderDetailID="40" AND OrderId="1000041044" ) OR ( OrderDetailID="30" AND OrderId="1000041044" ) OR ( OrderDetailID="20" AND OrderId="1000041044" ) OR ( OrderDetailID="10" AND OrderId="1000041044" ) OR ( OrderDetailID="40" AND OrderId="1000041043" ) OR ( OrderDetailID="30" AND OrderId="1000041043" ) OR ( OrderDetailID="20" AND OrderId="1000041043" ) OR ( OrderDetailID="10" AND OrderId="1000041043" ) OR ( OrderDetailID="10" AND OrderId="1000041042" ) OR ( OrderDetailID="40" AND OrderId="1000041042" ) OR ( OrderDetailID="30" AND OrderId="1000041042" ) OR ( OrderDetailID="20" AND OrderId="1000041042" ) OR ( OrderDetailID="40" AND OrderId="1000041041" ) OR ( OrderDetailID="30" AND OrderId="1000041041" ) OR ( OrderDetailID="20" AND OrderId="1000041041" ) OR ( OrderDetailID="10" AND OrderId="1000041041" ) OR ( OrderDetailID="40" AND OrderId="1000041040" ) OR ( OrderDetailID="30" AND OrderId="1000041040" ) OR ( OrderDetailID="20" AND OrderId="1000041040" ) OR ( OrderDetailID="10" AND OrderId="1000041040" ) OR ( OrderDetailID="10" AND OrderId="1000041039" ) OR ( OrderDetailID="40" AND OrderId="1000041039" ) OR ( OrderDetailID="30" AND OrderId="1000041039" ) OR ( OrderDetailID="20" AND OrderId="1000041039" ) OR ( OrderDetailID="40" AND OrderId="1000041038" ) OR ( OrderDetailID="30" AND OrderId="1000041038" ) OR ( OrderDetailID="20" AND OrderId="1000041038" ) OR ( OrderDetailID="10" AND OrderId="1000041038" ) OR ( OrderDetailID="40" AND OrderId="1000041037" ) OR ( OrderDetailID="30" AND OrderId="1000041037" ) OR ( OrderDetailID="20" AND OrderId="1000041037" ) OR ( OrderDetailID="10" AND OrderId="1000041037" ) OR ( OrderDetailID="10" AND OrderId="1000041036" ) OR ( OrderDetailID="40" AND OrderId="1000041036" ) OR ( OrderDetailID="30" AND OrderId="1000041036" ) OR ( OrderDetailID="20" AND OrderId="1000041036" ) OR ( OrderDetailID="40" AND OrderId="1000041035" ) OR ( OrderDetailID="30" AND OrderId="1000041035" ) OR ( OrderDetailID="20" AND OrderId="1000041035" ) OR ( OrderDetailID="10" AND OrderId="1000041035" ) OR ( OrderDetailID="40" AND OrderId="1000041034" ) OR ( OrderDetailID="30" AND OrderId="1000041034" ) OR ( OrderDetailID="20" AND OrderId="1000041034" ) OR ( OrderDetailID="10" AND OrderId="1000041034" ) OR ( OrderDetailID="10" AND OrderId="1000041033" ) OR ( OrderDetailID="40" AND OrderId="1000041033" ) OR ( OrderDetailID="30" AND OrderId="1000041033" ) OR ( OrderDetailID="20" AND OrderId="1000041033" ) OR ( OrderDetailID="40" AND OrderId="1000041032" ) OR ( OrderDetailID="30" AND OrderId="1000041032" ) OR ( OrderDetailID="20" AND OrderId="1000041032" ) OR ( OrderDetailID="10" AND OrderId="1000041032" ) OR ( OrderDetailID="40" AND OrderId="1000041031" ) OR ( OrderDetailID="30" AND OrderId="1000041031" ) OR ( OrderDetailID="20" AND OrderId="1000041031" ) OR ( OrderDetailID="10" AND OrderId="1000041031" ) OR ( OrderDetailID="10" AND OrderId="1000041030" ) OR ( OrderDetailID="40" AND OrderId="1000041030" ) OR ( OrderDetailID="30" AND OrderId="1000041030" ) OR ( OrderDetailID="20" AND OrderId="1000041030" ) OR ( OrderDetailID="40" AND OrderId="1000041029" ) OR ( OrderDetailID="30" AND OrderId="1000041029" ) OR ( OrderDetailID="20" AND OrderId="1000041029" ) OR ( OrderDetailID="10" AND OrderId="1000041029" ) OR ( OrderDetailID="40" AND OrderId="1000041028" ) OR ( OrderDetailID="30" AND OrderId="1000041028" ) OR ( OrderDetailID="20" AND OrderId="1000041028" ) OR ( OrderDetailID="10" AND OrderId="1000041028" ) OR ( OrderDetailID="10" AND OrderId="1000041027" ) OR ( OrderDetailID="40" AND OrderId="1000041027" ) OR ( OrderDetailID="30" AND OrderId="1000041027" ) OR ( OrderDetailID="20" AND OrderId="1000041027" ) OR ( OrderDetailID="40" AND OrderId="1000041026" ) OR ( OrderDetailID="30" AND OrderId="1000041026" ) OR ( OrderDetailID="20" AND OrderId="1000041026" ) OR ( OrderDetailID="10" AND OrderId="1000041026" ) OR ( OrderDetailID="40" AND

Re: search command

sundareshr — Thu, 25 Aug 2016 20:04:19 GMT

This looks right to me, does the query look right to you?. Are the field names identical (case sensitive)

Re: search command

woodcock — Thu, 25 Aug 2016 21:15:33 GMT

Like this:

index=parmed-stage OR (index=sapecc-stage source=DBX:SAPECC-SE8 sourcetype=DBX:SAP-SalesOrder)
| eval OrderId=coalesce(OrderId, SALESORDERNUM)
| eval OrderDetailID=coalesce(OrderDetailID, ITEMDETAILID)
| eventstats dc(index) AS numIndices
| search numIndices=1
| table _raw OrderId OrderDetailID