topic Re: Is there a way to do a NOT IN search in Splunk Search

Is there a way to do a NOT IN search

riotto — Thu, 27 Oct 2016 18:48:22 GMT

something like;

[search index= myindex source=server.log earliest=-360 latest=-60 "

Re: Is there a way to do a NOT IN search

cmerriman — Thu, 27 Oct 2016 18:51:23 GMT

are you trying to search for everything EXCEPT search index= myindex source=server.log earliest=-360 latest=-60

Re: Is there a way to do a NOT IN search

riotto — Thu, 27 Oct 2016 18:57:07 GMT

No, something like
earliest=-360 latest=-60 "

Re: Is there a way to do a NOT IN search

ppablo — Thu, 27 Oct 2016 19:04:29 GMT

@riotto

Can you give more details on what you're looking for with expected results? It's hard just figuring this out with only a search. People need more context here other than the same search you put in the content of your question.

Re: Is there a way to do a NOT IN search

riotto — Thu, 27 Oct 2016 19:04:32 GMT

can't paste my example?

Re: Is there a way to do a NOT IN search

riotto — Thu, 27 Oct 2016 19:11:03 GMT

it's cutting off my example sorry

Re: Is there a way to do a NOT IN search

cmerriman — Thu, 27 Oct 2016 19:12:50 GMT

when pasting your example, highlight the syntax and click on the little '101 010' icon above the texbox

Re: Is there a way to do a NOT IN search

riotto — Thu, 27 Oct 2016 19:17:42 GMT

[search index="idx" source="server.log" earliest=-360 latest=-60 "<Request" | xmlkv | fields clientId]
NOT IN
[search  index="idx" source="server.log" earliest=-360 latest=now "<Response" | xmlkv | fields clientId]`enter code here`

Re: Is there a way to do a NOT IN search

somesoni2 — Thu, 27 Oct 2016 20:03:58 GMT

Try like this

index="idx" source="server.log" earliest=-360 latest=-60 "<Request" | xmlkv | fields clientId | search NOT
 [search  index="idx" source="server.log" earliest=-360 latest=now "<Response" | xmlkv | stats count by clientId |table clientId]

Re: Is there a way to do a NOT IN search

riotto — Thu, 27 Oct 2016 21:21:27 GMT

it works! Thanks much

Re: Is there a way to do a NOT IN search

malvidin — Thu, 29 Oct 2020 18:01:10 GMT

I would recommend using an eventstats command to exclude

index="idx" earliest=-360s latest=-0s source="server.log" "<Request" | xmlkv | eventstats earliest_time(clientId) as earliest_clientId by clientId | where relative_time(now(), "-60s") > earliest_clientId |`enter code here`