how to implement minus query in splunk?

[meenal901]

Hi,

I have a lookup file which contains names of all services. From my logs, i get the current active/failed services. I want to find out the services which did not generate the logs. From SQL, i can implement a minus query to find out the difference in lookup and actual logs.
How to do this in Splunk?
I have tried set diff, but it is not giving the expected output.

Thanks,
Meenal

[adityapavan18]

May be you can try something like this(definetly not optimized solution but get does the job)

<search> | stats count by service | table service | append[|inputlookup allservices.csv|table service] | stats count by service | where count = 1

will provide all services for which logs are not generated.

[MuS · Accepted solution]

Hi meenal901

given your lookup table is like this:

my_name, my_description
foo_name, this is used for logging

get the entries from the lookup table first, filter it based on which host you are seeing in the system logs. Let's say your lookup table is called my_lookup.csv, the relevant logs have sourcetype my_systemlogs and that the field my_name exists in those log events. In that case, this search should get you going:

| inputlookup my_lookup.csv | search NOT [search sourcetype="my_systemlogs" | dedup my_name | fields my_name]

hope this helps or gets you starting to find the result you're looking for

cheers,

MuS