How to compose a search to compare the difference between hosts?

[masongalindo]

I am trying to build an alert off based of a search that shows me only hosts that have not logged the following string in an event within the last 4 hours:

"+[CHAIN] RETAIL_LOCATION_CLOSE" NOT ORDER

If this string isn't logged by a host, it tells me the operator did not perform an administrative task and I will want these hosts to appear in an alert.

I am assuming I need to perform two searches and compare the difference, but I am having a hard time composing the search.

So far I have the following, but I am not getting the expected result (which is the host difference between both searches)

| set diff [search index=my_index "+[CHAIN] RETAIL_LOCATION_CLOSE" NOT ORDER | table store ] [search index=my_index   | table store]

The first search is for my string of interest and the second is just a generic search to return all of the hosts in the index who are logging. I'd like to subtract all hosts who appear in the first search from those that appear in the second, and the difference is my list of hosts who need to be followed up with.

Any help for a big giant Splunk newb would be very appreciated.

[bkeif]

Try this:

index=foo1 NOT [search index=foo1 "+[CHAIN] RETAIL_LOCATION_CLOSE" NOT ORDER | dedup host | table host | format] | stats values(host)

The subsearch generates a list of unique hosts which have the specified string then formats the list for use in splunk search language. The base search takes that list and shows you everything not in it, that being, the severs that do not have the specified string. You can then alert off the results of the base search.

[renjith_nair]

Why don't you just try

index=my_index NOT  "+[CHAIN] RETAIL_LOCATION_CLOSE"|fields host

[richgalloway]

That wouldn't help because you can't search for something that isn't there. masongalindo's approach is the right one - start with all hosts and take away those that did something then you're left with those that did not do that thing. See https://answers.splunk.com/answers/456120/how-to-find-routers-that-are-not-reporting-a-speci.html for a solution that uses a lookup table.