Knowledge Management

how to get the list of hostname in one index that are not in another index in splunk

harishsplunk7
Explorer

We want all the hosts in index=aws that are NOT in index=windows. 


Example : 

| tstats count where index=aws by host | table host
| search NOT [| tstats count where index=windows by host | table host]

Labels (6)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi, please try this:

| tstats 
   dc(index) AS index_count 
   WHERE index IN (aws,windows) 
   BY host
| where index_count=2
| table host

Ciao.

Giuseppe

0 Karma

burwell
SplunkTrust
SplunkTrust

Hi. Your search is so close to what I do.. change search -> where

 

| tstats count where index=aws by host | table host
| where NOT [| tstats count where index=windows by host | table host]
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...