topic Re: Filter logs with different and same fields in Splunk Search

How to filter logs with different and same fields?

nmayafit — Wed, 22 Mar 2023 20:23:04 GMT

Hi. Subject is confusing so here goes. I have 3 log lines:

org=A Status=Success

org=A Status=Fail

org=B Status=Success

I would like to get stats for orgs that have Status=Success, but not if those orgs have even one log where Status=Fail.

I tried to filter in the search query (but then, I get the line where org=A Status=Success) and in a WHERE clause, with no luck. I'm trying to find the right method to do this kind of filtering.

Thanks!

Re: Filter logs with different and same fields

PickleRick — Tue, 21 Mar 2023 22:10:57 GMT

I assume these are three separate events. You can't filter one event based on value of another event. If you want just a summary of your orgs do something like that

<your base search>
| stats values(Status) by org
| where NOT Status="Fail"

If you want full events use eventstats instead of stats but be aware that eventstats is limited by resource constraints so may not work well on big datasets.

Re: Filter logs with different and same fields

nmayafit — Wed, 22 Mar 2023 07:17:23 GMT

Thanks.

I tried that already, but it still shows the results in the stats.

Re: Filter logs with different and same fields

ITWhisperer — Wed, 22 Mar 2023 08:01:23 GMT

| stats values(Status) as Status by org | where NOT Status="Fail"

Re: Filter logs with different and same fields

PickleRick — Wed, 22 Mar 2023 08:18:05 GMT

That's why I said - if you're ok with just the aggregation, use simple stats command. If you want to retain the original events, use eventstats (with the same syntax). Just be warned about the possible performance issues.

Re: Filter logs with different and same fields

nmayafit — Wed, 22 Mar 2023 08:33:04 GMT

I don't need the original events, so I use stats, but it still shows as a line with this values

Re: Filter logs with different and same fields

PickleRick — Wed, 22 Mar 2023 08:50:12 GMT

Right. Forgot to rename the resulting field with stats. See @ITWhisperer 's answer. It is conceptually the same as mine, it's just that he didn't forget to alias the field 🙂 His solution should work. Mine should also work if you replaced the where condition with:

| where NOT 'values(Status)'="Fail"

Re: Filter logs with different and same fields

nmayafit — Wed, 22 Mar 2023 08:53:42 GMT

I tried his and yours with no luck. Lines with the specific attributes still show.

Re: Filter logs with different and same fields

ITWhisperer — Wed, 22 Mar 2023 09:02:45 GMT

It seems like the information you have provided isn't sufficiently accurate for our suggested solutions to work. Please share more accurate representations of your raw events, preferably in a code block </> to prevent information being lost due to formatting.