All Apps and Add-ons

how to implement minus query in splunk?

meenal901
Communicator

Hi,

I have a lookup file which contains names of all services. From my logs, i get the current active/failed services. I want to find out the services which did not generate the logs. From SQL, i can implement a minus query to find out the difference in lookup and actual logs.
How to do this in Splunk?
I have tried set diff, but it is not giving the expected output.

Thanks,
Meenal

Tags (2)
0 Karma
1 Solution

MuS
Legend

Hi meenal901

given your lookup table is like this:

my_name, my_description
foo_name, this is used for logging

get the entries from the lookup table first, filter it based on which host you are seeing in the system logs. Let's say your lookup table is called my_lookup.csv, the relevant logs have sourcetype my_systemlogs and that the field my_name exists in those log events. In that case, this search should get you going:

| inputlookup my_lookup.csv | search NOT [search sourcetype="my_systemlogs" | dedup my_name | fields my_name]

hope this helps or gets you starting to find the result you're looking for

cheers,

MuS

View solution in original post

adityapavan18
Contributor

May be you can try something like this(definetly not optimized solution but get does the job)

<search> | stats count by service | table service | append[|inputlookup allservices.csv|table service] | stats count by service | where count = 1

will provide all services for which logs are not generated.

0 Karma

MuS
Legend

Hi meenal901

given your lookup table is like this:

my_name, my_description
foo_name, this is used for logging

get the entries from the lookup table first, filter it based on which host you are seeing in the system logs. Let's say your lookup table is called my_lookup.csv, the relevant logs have sourcetype my_systemlogs and that the field my_name exists in those log events. In that case, this search should get you going:

| inputlookup my_lookup.csv | search NOT [search sourcetype="my_systemlogs" | dedup my_name | fields my_name]

hope this helps or gets you starting to find the result you're looking for

cheers,

MuS

Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco &#43; Splunk! We’ve ...