Hi,
I have a lookup file which contains names of all services. From my logs, i get the current active/failed services. I want to find out the services which did not generate the logs. From SQL, i can implement a minus query to find out the difference in lookup and actual logs.
How to do this in Splunk?
I have tried set diff, but it is not giving the expected output.
Thanks,
Meenal
Hi meenal901
given your lookup table is like this:
my_name, my_description
foo_name, this is used for logging
get the entries from the lookup table first, filter it based on which host you are seeing in the system logs. Let's say your lookup table is called my_lookup.csv
, the relevant logs have sourcetype my_systemlogs
and that the field my_name
exists in those log events. In that case, this search should get you going:
| inputlookup my_lookup.csv | search NOT [search sourcetype="my_systemlogs" | dedup my_name | fields my_name]
hope this helps or gets you starting to find the result you're looking for
cheers,
MuS
May be you can try something like this(definetly not optimized solution but get does the job)
<search> | stats count by service | table service | append[|inputlookup allservices.csv|table service] | stats count by service | where count = 1
will provide all services for which logs are not generated.
Hi meenal901
given your lookup table is like this:
my_name, my_description
foo_name, this is used for logging
get the entries from the lookup table first, filter it based on which host you are seeing in the system logs. Let's say your lookup table is called my_lookup.csv
, the relevant logs have sourcetype my_systemlogs
and that the field my_name
exists in those log events. In that case, this search should get you going:
| inputlookup my_lookup.csv | search NOT [search sourcetype="my_systemlogs" | dedup my_name | fields my_name]
hope this helps or gets you starting to find the result you're looking for
cheers,
MuS