topic Return results that are in Index1 and NOT in Index2 in Splunk Search

Return results that are in Index1 and NOT in Index2

tristanmatthews — Mon, 28 Sep 2020 14:59:42 GMT

I have two indexes one contains objects of interest and things I don't care about, all_results, and the other is a list of things I know I don't care about, bad_results, I want to return elements of the first list that don't exist in the second. I was able to make it working by using.

Is there a simpler / better way to do this then something like:

index=all_results OR index=bad_results | eval isBad=if(index="bad_results", key, 0) | where key!=isBad | transaction key maxspan=1d maxevents=-1

Thanks

Re: Return results that are in Index1 and NOT in Index2

gkanapathy — Wed, 16 Oct 2013 21:59:32 GMT

index=all_results NOT [ search index=bad_results | return 10000 key ]

if you have 10000 or fewer distinct keys in bad_results or:

index=all_results OR index=bad_results | stats count(eval(index=="bad_results")) as b by key | where b<1

doesn't appear simpler than yours, but it runs better if you have a multi-node Splunk system. on the other hand, it doesn't return the whole item, just the key, though you can fix that by adding first(otherfield) as otherfield to the stats command.