topic Re: Filter on multiple events in Splunk Search

How to filter on multiple events?

harryvdtol — Mon, 19 Sep 2022 15:42:01 GMT

Hello,

I have a search that outputs table data that looks like this:

hst code type hosta 01 master hosta 02 master hostb 01 host hostb 03 host hostc 02 host hostd 04 host hoste 05 master hoste 06 master hostf 06 host hostg 08 host

etc.etc...

I am trying to filter events but i am unable to do.

My goal is to filter events based on this condition:
If the code on a master also exist on the host, then the host rows should be removed

So, my desired output should look like this:

hst code type hosta 01 master hosta 02 master hostb 03 host hostd 04 host hoste 05 master hoste 06 master hostg 08 host

I hope someone can help me.
Thanks in advance.

Regards,

Harry

Re: Filter on multiple events

gcusello — Mon, 19 Sep 2022 08:48:02 GMT

Hi @harryvdtol,

please try something like this:

<your_search> | stats first(host) AS host BY code type | table host code type

Ciao.

Giuseppe

Re: Filter on multiple events

harryvdtol — Mon, 19 Sep 2022 10:28:10 GMT

Yes thank you for your help. This is what i made of it.

.. | stats first(hst) as host by code type | eventstats c as total by code | where (type="master") OR (total=1 and type="host") | table host code type

Re: Filter on multiple events

gcusello — Mon, 19 Sep 2022 11:03:44 GMT

Hi @harryvdtol,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉