topic Re: Differences between search results in Splunk Search

Differences between search results

srinathd — Thu, 07 Nov 2013 10:15:44 GMT

Hello,
I have a lookup table called host-list which has a list of all the hosts present in a network. I want to have a daily search that finds the list of hosts from where the log files are not generated. That is, I want to compare the list of all hosts present in host-list with the list of hosts from the log files and generate a table which shows all the "unresponsive" hosts, as in, the hosts which do not generate log files.

I tried using map, diff, NOT and various other options but none seem to work. Any help?

Sample search I used which didn't work:
|inputlookup host-list | table host | where host NOT [search index=my_index earliest=-d@d latest=@d | fields hosts]

Re: Differences between search results

martin_mueller — Thu, 07 Nov 2013 10:30:01 GMT

Try something like this:

| inputlookup host-list | search NOT [search index=myindex earliest=-d@d latest=@d | fields host | dedup host]

It'll grab the list of unique host values from yesterday, build a huge (NOT ((host=A) OR (host=B) OR ...)) filter, and apply that to the results of the inputlookup.

Re: Differences between search results

somesoni2 — Thu, 07 Nov 2013 18:49:58 GMT

This may perform faster

|inputlookup host-list | table host  | join type=outer host [search index=my_index earliest=-d@d latest=@d | stats count by hosts | rename hosts as host | fields - count| eval status="Responsive"]|eval status=COALESCE(status,"Unresponsive") | where status="Unresponsive"

The inner search will fetch distinct host from which data is coming and they add a field status="Responsive". You join this with your lookup data by host and with outer join, un-matched hosts will have status=NULL that we are transforming as "Unresponsive".