Splunk Search

Find unique events in one search and NOT the other

Joe20
Explorer

I have events with two keys area and errortext. Sample event below: 

 

[2021-02-20 19:27:37.599 GMT] ERROR Servlet|test-event| element=PlaceOrder,routine=start,receiptNumber=000006,errortext="Initiating ReversePayments for Order, Reason: Inventory reservation failed"

I need to find :

1. unique events that match element and errortext values for a time window -1

2. find the same unique events for a time window-2  then 

3. find events that are present in time window-1 and NOT in time window-2 

To find unique events in time-window-1  --I am using the below query. 

 

index=dev sourcetype!=warn element AND errortext earliest=@w5 latest=+7d@w6 | dedup element,errortext | table element,errortext

 I am trying to use search and NOT but not able do so in this case. 

SearchOne NOT [ SearchTwo ]

 

Labels (2)
Tags (1)
0 Karma
1 Solution

tscroggins
Motivator

@Joe20 

Using an example time window of 24 hours, try:

element=* errortext=* earliest=-24h latest=now NOT [ element=* errortext=* earliest=-48h latest=-24h | table element errortext ]

This will return events over the last 24 hours with key field combinations (element AND errortext) that were not present between 48 and 24 hours ago.

You may want to review timestamp extractions and time zone offsets if you frequently need to search for future times, e.g. +7d@w6, and those future times are not be design.

View solution in original post

Joe20
Explorer

This worked. Thank you very much @tscroggins

0 Karma

tscroggins
Motivator

@Joe20 

Using an example time window of 24 hours, try:

element=* errortext=* earliest=-24h latest=now NOT [ element=* errortext=* earliest=-48h latest=-24h | table element errortext ]

This will return events over the last 24 hours with key field combinations (element AND errortext) that were not present between 48 and 24 hours ago.

You may want to review timestamp extractions and time zone offsets if you frequently need to search for future times, e.g. +7d@w6, and those future times are not be design.

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...