Splunk Search

How to compose a search to compare the difference between hosts?

masongalindo
New Member

I am trying to build an alert off based of a search that shows me only hosts that have not logged the following string in an event within the last 4 hours:

"+[CHAIN] RETAIL_LOCATION_CLOSE" NOT ORDER

If this string isn't logged by a host, it tells me the operator did not perform an administrative task and I will want these hosts to appear in an alert.

I am assuming I need to perform two searches and compare the difference, but I am having a hard time composing the search.

So far I have the following, but I am not getting the expected result (which is the host difference between both searches)

| set diff [search index=my_index "+[CHAIN] RETAIL_LOCATION_CLOSE" NOT ORDER | table store ] [search index=my_index   | table store]

The first search is for my string of interest and the second is just a generic search to return all of the hosts in the index who are logging. I'd like to subtract all hosts who appear in the first search from those that appear in the second, and the difference is my list of hosts who need to be followed up with.

Any help for a big giant Splunk newb would be very appreciated.

0 Karma

bkeif
Path Finder

Try this:

index=foo1 NOT [search index=foo1 "+[CHAIN] RETAIL_LOCATION_CLOSE" NOT ORDER | dedup host | table host | format] | stats values(host)

The subsearch generates a list of unique hosts which have the specified string then formats the list for use in splunk search language. The base search takes that list and shows you everything not in it, that being, the severs that do not have the specified string. You can then alert off the results of the base search.

0 Karma

renjith_nair
Legend

Why don't you just try

index=my_index NOT  "+[CHAIN] RETAIL_LOCATION_CLOSE"|fields host
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

richgalloway
SplunkTrust
SplunkTrust

That wouldn't help because you can't search for something that isn't there. masongalindo's approach is the right one - start with all hosts and take away those that did something then you're left with those that did not do that thing. See https://answers.splunk.com/answers/456120/how-to-find-routers-that-are-not-reporting-a-speci.html for a solution that uses a lookup table.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...