Splunk Search

Compare two searches and show differences

jpetrov
New Member

Hi All,

I'm trying to gain some visibility into whether scans are completing on all hosts, at the moment they are not and I would like to easily see which ones are not working properly. I want to have three panels. One showing all hosts, the next showing all hosts in which scans have finished, and the last showing the difference between the two, ie showing hosts in which scans did not complete. I have to two easy queries complete, but can't seem to get the last one working:
1. host=* | top host limit=1000 | chart count
2. host=* "Writing report to /var/log/openvas/reports/report.xml" | chart count ]

Basically I want to show query 1 minus the results from query 2, so that I can see the hostnames of the boxes that are not completing the scan. I've tried diff and sub-searches with no luck, however I may have the syntax wrong. Any help would be hugely appreciated.

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Try using this (validate the queries, both should have same columns)

|set diff [search host=* | top host limit=1000 | chart count] [search  host=* "Writing report to /var/log/openvas/reports/report.xml" | chart count ]

Updated:

try this

host=* NOT [search host=* "Writing report to /var/log/openvas/reports/report.xml" | stats count by host | fields - count] | chart count

View solution in original post

somesoni2
Revered Legend

Try using this (validate the queries, both should have same columns)

|set diff [search host=* | top host limit=1000 | chart count] [search  host=* "Writing report to /var/log/openvas/reports/report.xml" | chart count ]

Updated:

try this

host=* NOT [search host=* "Writing report to /var/log/openvas/reports/report.xml" | stats count by host | fields - count] | chart count

jpetrov
New Member

I got it, just need to take off chart count

0 Karma

jpetrov
New Member

I added | top host limit=1000 | to just show the number of hosts and I am finally seeing the correct number. The only remaining issue is that I would like to see the hostnames listed out rather than just the count number, or at least be able to drill down from the count number to see the list of hosts.

Thanks again for the help!

0 Karma

somesoni2
Revered Legend

My bad, let me know if the updated answer worked (or didn't work).

0 Karma

jpetrov
New Member

Thanks for the fast reply somesoni2,
This is not exactly what I am looking for. I basically need this panel to show all hosts that do not have the string "Writing report to /var/log/openvas/reports/report.xml" anywhere on them within the search time. I have tried host=* NOT "Writing report to /var/log/openvas/reports/report.xml", however this still shows all hosts, it just excludes that string.

I'm guessing there has to be an easy way to do this, I just haven't found it yet :slightly_smiling_face:

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...