Knowledge Management

how to get the list of hostname in one index that are not in another index in splunk

harishsplunk7
Explorer

We want all the hosts in index=aws that are NOT in index=windows. 


Example : 

| tstats count where index=aws by host | table host
| search NOT [| tstats count where index=windows by host | table host]

Labels (6)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi, please try this:

| tstats 
   dc(index) AS index_count 
   WHERE index IN (aws,windows) 
   BY host
| where index_count=2
| table host

Ciao.

Giuseppe

0 Karma

burwell
SplunkTrust
SplunkTrust

Hi. Your search is so close to what I do.. change search -> where

 

| tstats count where index=aws by host | table host
| where NOT [| tstats count where index=windows by host | table host]
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...