Splunk Search

Find unique events in one search and NOT the other

Joe20
Explorer

I have events with two keys area and errortext. Sample event below: 

 

[2021-02-20 19:27:37.599 GMT] ERROR Servlet|test-event| element=PlaceOrder,routine=start,receiptNumber=000006,errortext="Initiating ReversePayments for Order, Reason: Inventory reservation failed"

I need to find :

1. unique events that match element and errortext values for a time window -1

2. find the same unique events for a time window-2  then 

3. find events that are present in time window-1 and NOT in time window-2 

To find unique events in time-window-1  --I am using the below query. 

 

index=dev sourcetype!=warn element AND errortext earliest=@w5 latest=+7d@w6 | dedup element,errortext | table element,errortext

 I am trying to use search and NOT but not able do so in this case. 

SearchOne NOT [ SearchTwo ]

 

Labels (2)
Tags (1)
0 Karma
1 Solution

tscroggins
Builder

@Joe20 

Using an example time window of 24 hours, try:

element=* errortext=* earliest=-24h latest=now NOT [ element=* errortext=* earliest=-48h latest=-24h | table element errortext ]

This will return events over the last 24 hours with key field combinations (element AND errortext) that were not present between 48 and 24 hours ago.

You may want to review timestamp extractions and time zone offsets if you frequently need to search for future times, e.g. +7d@w6, and those future times are not be design.

View solution in original post

Joe20
Explorer

This worked. Thank you very much @tscroggins

0 Karma

tscroggins
Builder

@Joe20 

Using an example time window of 24 hours, try:

element=* errortext=* earliest=-24h latest=now NOT [ element=* errortext=* earliest=-48h latest=-24h | table element errortext ]

This will return events over the last 24 hours with key field combinations (element AND errortext) that were not present between 48 and 24 hours ago.

You may want to review timestamp extractions and time zone offsets if you frequently need to search for future times, e.g. +7d@w6, and those future times are not be design.

View solution in original post

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!