I am trying to list the events from the subsearch which are not found in the main search.
For example the subsearch returns the table with the following records:
And the main search returns the following records:
So the final result will be "D"
There is an "Exclusive Right Join" concept in SQL.
Can i achieve something similar in Splunk? I have looked at the "join" command documentation but it does not support this specific type.
There are several ways of going about what you're requesting. I'll suggest one, and if it doesn't work for you, maybe you can provide more details about your specific use case, and I'll try again.
Let's say you have a main search and a subsearch that both return events containing the field
unique_id, and the value of the
unique_id field matches your map above (results from the subsearch include
unique_id=D; results from the main search include
unique_id=C). So your goal would be to retain the event with
unique_id=D. Then I'd structure the approach like this:
base search | eval found_in_base_search=1 | append [ subsearch | eval found_in_sub_search=1 ] | eventstats values(found_in_base_search) AS found_in_base_search BY unique_id | where isnull(found_in_base_search) AND isnotnull(found_in_sub_search)
eventstats portion of the search will apply the field
found_in_base_search across all events sharing the same
unique_id, so then we just filter down to events that contain the field
found_in_sub_search but do not contain the field
No, this doesn't work for me. To test this for both main search and sub-search I selected the same interval: "earliest=-15m@m latest=-5m@m". So in theory no events should be returned as time periods fully overlap. However this is not the case.