topic splunk query with specific product id count in Splunk Search

splunk query with specific product id count

freephoneid — Tue, 03 Apr 2012 21:45:32 GMT

Hi,

My log contains below entries:

activated=true productid=8432 userid=123 email=abc@abc.com
activated=false productid=8432 userid=2123 email=12@a212bc.com
activated=true productid=3422 userid=434123 email=pqe@dfd.com
activated=true productid=433232 userid=7468 email=434@a43433c.com

I want to find the count for all those users who have activated=true and whose productids are not 645,423,433232,7483,57893,45673,847832,48832,4323,432,3323,323,12,233,234545,2323

Can any one provide me the query for the same?

Thanks

Re: splunk query with specific product id count

gkanapathy — Tue, 03 Apr 2012 22:34:47 GMT

activated=true NOT productid=645 NOT productid=423 NOT productid=433232 NOT productid=7483 ... | stats count

Re: splunk query with specific product id count

freephoneid — Wed, 04 Apr 2012 00:02:05 GMT

Hi gkanapathy....The product id list is more than 30...Is there another way to implement this query?

Re: splunk query with specific product id count

gooza — Wed, 04 Apr 2012 06:44:12 GMT

use lookup tables , list the product id you're looking for in csv and add a seen field to it:

productid,seen

645,1

423,1
and so on

then run the search

activated=true | lookup yourlookuptable productid OUTPUT seen | Where seen!=1

you can read more on lookup tables at:

docs.splunk.com

Re: splunk query with specific product id count

gkanapathy — Wed, 04 Apr 2012 14:38:06 GMT

if you look at gooza's answer, you can do it with a lookup table. it's actually better (much better) with a subsearch and a lookup definedd like he has, and then doing:

activated=true NOT [ inputlookup yourlookuptable | return 10000 productid ] | stats count

which will work with up to 10000 productids.