All Apps and Add-ons

how to implement minus query in splunk?

meenal901
Communicator

Hi,

I have a lookup file which contains names of all services. From my logs, i get the current active/failed services. I want to find out the services which did not generate the logs. From SQL, i can implement a minus query to find out the difference in lookup and actual logs.
How to do this in Splunk?
I have tried set diff, but it is not giving the expected output.

Thanks,
Meenal

Tags (2)
0 Karma
1 Solution

MuS
Legend

Hi meenal901

given your lookup table is like this:

my_name, my_description
foo_name, this is used for logging

get the entries from the lookup table first, filter it based on which host you are seeing in the system logs. Let's say your lookup table is called my_lookup.csv, the relevant logs have sourcetype my_systemlogs and that the field my_name exists in those log events. In that case, this search should get you going:

| inputlookup my_lookup.csv | search NOT [search sourcetype="my_systemlogs" | dedup my_name | fields my_name]

hope this helps or gets you starting to find the result you're looking for

cheers,

MuS

View solution in original post

adityapavan18
Contributor

May be you can try something like this(definetly not optimized solution but get does the job)

<search> | stats count by service | table service | append[|inputlookup allservices.csv|table service] | stats count by service | where count = 1

will provide all services for which logs are not generated.

0 Karma

MuS
Legend

Hi meenal901

given your lookup table is like this:

my_name, my_description
foo_name, this is used for logging

get the entries from the lookup table first, filter it based on which host you are seeing in the system logs. Let's say your lookup table is called my_lookup.csv, the relevant logs have sourcetype my_systemlogs and that the field my_name exists in those log events. In that case, this search should get you going:

| inputlookup my_lookup.csv | search NOT [search sourcetype="my_systemlogs" | dedup my_name | fields my_name]

hope this helps or gets you starting to find the result you're looking for

cheers,

MuS

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...