Hey everyone, I'm stumped trying to put together a query to find specific hosts that return some value but not some other possible values over a given timeframe, where each result is itself a separate log entry (and each device returns multiple results each time it does an operation).
E.g., given a list of possible results, the data itself looks something like this:
(results from today:)
hostname=x result=2
hostname=x result=3
hostname=y result=1
hostname=z result=1
(results from yesterday/previous days:)
hostname=x result=1
hostname=y result=1
hostname=z result=1
and I need to find all hostnames that had a result of "1" but also not results "2" or "3" over some given timeframe. So, from the data above, I'd be looking to return hostnames "y" and "z", but not "x". Unfortunately, the timeframe would be weeks, and would be looking at many thousands of possible hostnames. The only data point I'd know ahead of time would be the list of possible results (it'd only be a handful of possibilities, but a device can potentially return some/all of them at once).
Any advice on where to start? Thanks!
