Getting a record which does not have a particular event

[JJ_singh]

Hi,

I am trying to filter out unique request which does have a particular event. For instance, each request can go through following events

1. receive

2. process

3. publish

we publish all events for every requests in splunk. I am trying to write a query to find all the uniq request ( let's say represented by requestId) which does not have a "publish" event.

How can I achieve it?  I have tried using`NOT` but that just ignore the event, In fact I want to eval. Any suugestions?

[renjith_nair]

If there a field to distinguish the type of event say event_type,

""your search"|stats values(event_type) as event_types by requestId
|where isnull(mvfind(event_types,"publish"))

Try without the where clause to see how your events are grouped.

You may add additional fields to the stats or replace stats with eventstats