topic Re: Make sure Value from one specific event is not in any other events in Splunk Search

Make sure Value from one specific event is not in any other events

splunk219783 — Tue, 05 Jul 2022 15:26:55 GMT

I can't wrap my head around how to do this search. It's like I need an array or variable.

Example Data:

Hostname	Storage
BackupServer	BackupStorage
Database1	Storage1
Database2	Storage2
Database3	BackupStorage

How can I say, show me a list of all servers using BackupServer[Storage], I dont know the name of backup storage in advance. All I know is the hostname is like Backupserver.

Re: Make sure Value from one specific event is not in any other events

ITWhisperer — Tue, 05 Jul 2022 15:49:01 GMT

Do you mean something like this?

| eventstats values(Hostname) as hosts by Storage | where isnotnull(mvfind(hosts,"BackupServer"))

Re: Make sure Value from one specific event is not in any other events

splunk219783 — Tue, 05 Jul 2022 16:30:30 GMT

When I try that I just get my BackupServer. I shouldn't clarified, i'd like a search that only Shows me Database3 in the example dataset, but without knowing the Storage is "BackupStorage" to begin with. I need to lookup the datastore of backupserver, then make sure none of the others are on there.

Re: Make sure Value from one specific event is not in any other events

ITWhisperer — Tue, 05 Jul 2022 16:43:33 GMT

I am not sure I understand your requirement - do you know the name of the BackupServer or not?

| eventstats values(Hostname) as hosts by Storage | where isnotnull(mvfind(hosts,"BackupServer")) AND Hostname!="BackupServer"

If not, how do you identify which host is being used for backup storage?

Re: Make sure Value from one specific event is not in any other events

PickleRick — Tue, 05 Jul 2022 16:49:07 GMT

<your search>
| stats values(Hostname) as Hostname by Storage
| where Hostname="BackupServer"

Re: Make sure Value from one specific event is not in any other events

splunk219783 — Tue, 05 Jul 2022 17:05:01 GMT

I apologize if I'm being confusing. Let me try to explain it better. This backup server backups databases. I need to make sure none of the databases are on the same storage as the backup server. Because if we lost that storage we would lose both our backups and the database.

Here's the steps i'm trying to do with SPL.

1. Lookup what storage BackupServer is using with a search. Something like a

index=servers server=backups | fields Storage

2. Make sure No Databases are using that Storage. I do not know which storage the backup server will be on, it could move around.

index=servers server=*Database* storage!=[Storagestringfromabove]

This is the search i've thrown together so far. The only way I can think of to accomplish 1 & 2, is to output my backup storage to a lookup table, then look for a match.

index=servers source=*vmdk* VM=*database*| fields Datastore VM | search [inputlookup backup_server.csv | fields Datastore] | table VM Datastore

Re: Make sure Value from one specific event is not in any other events

ITWhisperer — Tue, 05 Jul 2022 17:28:06 GMT

This line creates a list of all the host which share the same storage by storage name

| eventstats values(Hostname) as hosts by Storage

This line picks out the hosts which share the same storage as BackupServer

| where isnotnull(mvfind(hosts,"BackupServer")) AND Hostname!="BackupServer"

How is that not what you have asked for?

Re: Make sure Value from one specific event is not in any other events

yuanliu — Tue, 05 Jul 2022 23:18:26 GMT

Based on your illustrations 1 and 2, I think ITWhisperer's method should work, like this:

index=servers (server=backups OR server=*Database*) | eventstats values(server) as servergroup by Storage | where isnull(mvfind(servergroup, backups))

Basically, eventstats groups servers based on Storage they use; mvfind() selects those servers that uses the same Storage as used by "backups". Then, isnull() negates the find to pick out those that do not use that storage.

Re: Make sure Value from one specific event is not in any other events

splunk219783 — Fri, 08 Jul 2022 12:21:33 GMT

Apologies for the delayed response, I was out of the office for a few days. Your example does work, thank you! I must've had a typo or something initially.