Splunk Search

How to exclude results in Search1 that are returned from Search2?

clarksinthehill
Explorer

I have a set of data that I would like to exclude the second search result set from.

First search: Gets me all the error files.

index=foo sourcetype="blah" (host="xxx*" OR host="xxx*") DownloadException" NOT ("pdf.*" OR "jpg.*") | rex "Error in reading an asset: (?<uid>.*)\." | eval asset_uid=substr(uid,len(uid)-35) | dedup asset_uid| table asset_uid

sample data: (about 1k reords)

a562e77e-2291-44d7-94a9-0fcc97621288
d4852cc6-c92d-4748-83b3-0c32d20dd6cf

second search: Gets me all the file not found error files.

index=foo sourcetype="blah" (host="xxx*" OR host="xxx*") FileNotFoundException NOT ("pdf.*" OR "jpg.*") | rex "FileNotFoundException: (?<file>.*)\." | eval asset_fail_uid=substr(file,len(file)-35) | table asset_fail_uid

I would like to exclude all records from second search from first search. Any help is appreciated. Thanks.

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

index=foo sourcetype="blah" (host="xxx*" OR host="xxx*") (FileNotFoundException OR DownloadException) NOT ("pdf.*" OR "jpg.*")
| eval ExceptionType=if(searchmatch("FileNotFoundException"), "FileNotFoundException", "DownloadException")
| rex "Error in reading an asset: (?<uid>.*)\."
| rex "FileNotFoundException: (?<file>.*)\."
| eval asset_uid=coalesce(substr(uid,len(uid)-35), substr(file,len(file)-35))
| eventstats dc(ExceptionType) AS numExceptionTypes values(ExceptionType) AS ExceptionTypes
| search numExceptionTypes=1 AND ExceptionType="DownloadException"

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

index=foo sourcetype="blah" (host="xxx*" OR host="xxx*") (FileNotFoundException OR DownloadException) NOT ("pdf.*" OR "jpg.*")
| eval ExceptionType=if(searchmatch("FileNotFoundException"), "FileNotFoundException", "DownloadException")
| rex "Error in reading an asset: (?<uid>.*)\."
| rex "FileNotFoundException: (?<file>.*)\."
| eval asset_uid=coalesce(substr(uid,len(uid)-35), substr(file,len(file)-35))
| eventstats dc(ExceptionType) AS numExceptionTypes values(ExceptionType) AS ExceptionTypes
| search numExceptionTypes=1 AND ExceptionType="DownloadException"
0 Karma

clarksinthehill
Explorer

Wow, thanks. I just ran the query and it returns no results, which is good.

Thanks for the help!

Get Updates on the Splunk Community!

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...

Stay Connected: Your Guide to February Tech Talks, Office Hours, and Webinars!

&#x1f48c;Keep the new year’s momentum going with our February lineup of Community Office Hours, Tech Talks, ...