Match and Exclude Specific Values in a Dynamic Field

[cquinney]

Greetings Splunkers,

I'm attempting to create a dashboard panel that creates a count of "Roles" by Role_Names, however, I need to exclude specific field values from a dynamic field labeled "Roles" based on the Role_Name.

For example, if I have Role_Name=Security AND Roles=A, B, C, D, I want to exclude all those "Roles" for that specific "Role_Name and return a count value of "0". However, today, the "Roles" for Role_Name=Security can equal A, B, C, & D but next week it might equal A, B, & F, in this case, I'd want to still exclude A & B but count F.

Additionally, Roles can be associated with other Role_Names so I can't just exclude them from the search altogether. I know there's a way to accomplish this I just can't recall it. Any assistance is greatly appreciated.

[cquinney]

I was able to find the answer with the assistance of a colleague. After running a stats command to correlate the data based on specific prerequisites, I did the following:

| mvexpand Roles
| search NOT (Role_Name=Security (Roles=A OR Role=B OR etc))
| stats values(blah) as blah count(Roles) as Role_Count by Role_Name

This provided me with my desired outcome and keeps my "Role_Count" flexible for that particular Role_Name. Hope this helps someone else down the line as well.