How do I search for events that do not have anothe... - Splunk Community

Splunk Search

I want to search for events that do not have a specific other event occurring within a certain time.

For example, I want to find all instances of EventCode=1 where there is no EventCode=2 within 5 minutes.

If you would like a specific answer you'll need to provide your SPL and examples of your events but in theory you could do that using a subsearch.

sourcetype=some_sourcetype NOT [search sourcetype=another_sourcetype | fields field_val]

https://docs.splunk.com/Documentation/Splunk/7.0.3/Search/Usesubsearchtocorrelateevents

Get Updates on the Splunk Community!

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Thanks for the Memories! Splunk University, .conf25, and our Community

Thank you to everyone in the Splunk Community who joined us for .conf25, which kicked off with our iconic ...