Splunk Dev

How do you write a query that lists events from source type A only when a corresponding event in source type B doesn't contain a specific event code?

maniishpawar
Path Finder

Hi,

I am trying to write a query to list events from source type A only when the corresponding event in source type B does not contain a specific event code. I believe the only correlation element here is the _time.

Real scenario: every time we deploy a build, there are some entries in a log file, but IIS server also generate an error event code at that time. I wanted to capture the IIS errors only when there is no build deployment.

Thanks

Tags (1)
0 Karma

maniishpawar
Path Finder

Thank you for the query. but i tried using transactions it grouped the events but I dont have a way to say
startwith and does not endwith
| transaction host maxspan=2m startswith=(EventCode="5009") NOT (endswith=(EventCode="10003"))

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

Try a subsearch, something like this:

sourcetype=access_combined NOT 
    [ search sourcetype=linux_secure 
    | eval clientip=dest 
    | fields clientip]

If the fieldnames are the same in each source, you won't need to do the eval that I did in my subsearch. This search above will show all of the clientip field values, within the time frame that I am searching, where those ip addresses aren't in the linux_secure sourcetype in the dest field.

I know this isn't specific to your data sources, but hopefully, you can extrapolate the concept to use in your search.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...