Knowledge Management
Highlighted

How to list missing event types that don't match any events in the defined period of time?

Path Finder

Hello,

Is there a way in Splunk to get a list of event types which don't match any events in the defined period of time?
I only know how to do the opposite thing.
I need this to clean up irrelevant event types.

Thank you.

0 Karma
Highlighted

Re: How to list missing event types that don't match any events in the defined period of time?

Motivator

Check out this answers post. You would need some sort of lookup file that listed all of the event types. You would search the lookup as your base search with a subsearch of the events, where the common field (eventtype) is NOT in the search of the events.

Answers post

Highlighted

Re: How to list missing event types that don't match any events in the defined period of time?

SplunkTrust
SplunkTrust

hello there,

here is an alternative to the lookup approach
this search capture all eventtypes in your splunk using rest:

| rest /services/saved/eventtypes
| table title 

you can add couple fields to the search eai:acl.app search and outputlookup and used the approach shown above by @kmorris

set your time picker
and run the following to find which eventtypes are not being "used" in that particular time frame:

  | set diff [ | search index = * 
    | stats count by eventtype 
    | fields - count ]
    [| rest /services/saved/eventtypes
    | table title 
    | rename title as eventtype ]

hope it helps

Highlighted

Re: How to list missing event types that don't match any events in the defined period of time?

Path Finder

Thanks to all for the responses.
I've used the following search

| rest /services/saved/eventtypes | table title | rename title as eventtype | join type=left eventtype [search index="myindex" | stats count by eventtype] | eval count = if(isnull(count), 0, count) | sort -count

and got a list of all event types paired with an amount of corresponding events.

View solution in original post

0 Karma
Highlighted

Re: How to list missing event types that don't match any events in the defined period of time?

SplunkTrust
SplunkTrust

great!
kindly accept your answer so others will know its a valid solution for you

0 Karma