Splunk Search

How do I show only field values that are missing from one of the 2 splunk searches?

shruthibm
New Member

I have 2 events

Event1: Document uploaded <documentId>

Event2: Document viewed <documentId>

 

I have generated a common "docId" field for both events. I want to create a table that lists document Ids that have been uploaded but not viewed. 

Ex: If I have the following events,

Document uploaded: 34423434
Document uploaded: 56676886
Document viewed: 56676886


I want a table that shows the below output

DocumentIdsNotViewed
34423434



Thanks in advance!


Labels (4)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @shruthibm,

you should try something like this:

<your-search> ("Document uploaded" OR "Document viewed"
| eval type=if(searchmatch("Document uploaded"),"Document uploaded","Document viewed")
| stats dc(type) AS type_count values(type) AS type BY documentId
| where type_count=1 AND type="Document uploaded"

Ciao.

Giuseppe

inventsekar
SplunkTrust
SplunkTrust

sure I understand this request, lets give this a try:

... | stats count(docId) as docIdCount | where docIdCount = 1

 

edit... oops, after few hrs, i understood that the logic is missing its idea. some trial and error on SPL creation is needed.

lets try this:

... | stats count(docId) as docIdCount by docId | where docIdCount = 1

 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...