Deployment Architecture

How to implement "not in" in splunk?

flzhang132
Explorer

How to implement "not in" in splunk?
I want to find out the data that is not in the collection, as shown below
alt text
But always make mistakes, as shown below.
alt text

Tags (1)
0 Karma

vishaltaneja070
Motivator

Hello @flzhang132,

Just try this:

index="feeindex" sourcetype=csv dmon=201809
| search NOT [|search index="di_project_map_merger"] | fields project

Just make sure field name in both the index feeindex and "di_project_map_merger" have same field name project

Other wise rename field name in the subsearch

0 Karma

kristian_kolb
Ultra Champion

Assuming that these strings ("App", "APP", "001" etc) are field values of the same field in both indexes - lets call it 'blah' - you could make a subsearch like so;

index=feeindex NOT [search index=di_project_map_merge | dedup blah | table blah] | table blah

But perhaps you are looking for something different?

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...