topic Re: How to exclude results in Search1 that are returned from Search2? in Splunk Search

How to exclude results in Search1 that are returned from Search2?

clarksinthehill — Wed, 22 Jun 2016 20:40:24 GMT

I have a set of data that I would like to exclude the second search result set from.

First search: Gets me all the error files.

index=foo sourcetype="blah" (host="xxx*" OR host="xxx*") DownloadException" NOT ("pdf.*" OR "jpg.*") | rex "Error in reading an asset: (?<uid>.*)\." | eval asset_uid=substr(uid,len(uid)-35) | dedup asset_uid| table asset_uid

sample data: (about 1k reords)

a562e77e-2291-44d7-94a9-0fcc97621288
d4852cc6-c92d-4748-83b3-0c32d20dd6cf

second search: Gets me all the file not found error files.

index=foo sourcetype="blah" (host="xxx*" OR host="xxx*") FileNotFoundException NOT ("pdf.*" OR "jpg.*") | rex "FileNotFoundException: (?<file>.*)\." | eval asset_fail_uid=substr(file,len(file)-35) | table asset_fail_uid

I would like to exclude all records from second search from first search. Any help is appreciated. Thanks.

Re: How to exclude results in Search1 that are returned from Search2?

woodcock — Wed, 22 Jun 2016 21:07:14 GMT

Like this:

index=foo sourcetype="blah" (host="xxx*" OR host="xxx*") (FileNotFoundException OR DownloadException) NOT ("pdf.*" OR "jpg.*")
| eval ExceptionType=if(searchmatch("FileNotFoundException"), "FileNotFoundException", "DownloadException")
| rex "Error in reading an asset: (?<uid>.*)\."
| rex "FileNotFoundException: (?<file>.*)\."
| eval asset_uid=coalesce(substr(uid,len(uid)-35), substr(file,len(file)-35))
| eventstats dc(ExceptionType) AS numExceptionTypes values(ExceptionType) AS ExceptionTypes
| search numExceptionTypes=1 AND ExceptionType="DownloadException"

Re: How to exclude results in Search1 that are returned from Search2?

clarksinthehill — Wed, 22 Jun 2016 21:34:42 GMT

Wow, thanks. I just ran the query and it returns no results, which is good.

Thanks for the help!