I have a set of data that I would like to exclude the second search result set from.
First search: Gets me all the error files.
index=foo sourcetype="blah" (host="xxx*" OR host="xxx*") DownloadException" NOT ("pdf.*" OR "jpg.*") | rex "Error in reading an asset: (?<uid>.*)\." | eval asset_uid=substr(uid,len(uid)-35) | dedup asset_uid| table asset_uid
sample data: (about 1k reords)
a562e77e-2291-44d7-94a9-0fcc97621288
d4852cc6-c92d-4748-83b3-0c32d20dd6cf
second search: Gets me all the file not found error files.
index=foo sourcetype="blah" (host="xxx*" OR host="xxx*") FileNotFoundException NOT ("pdf.*" OR "jpg.*") | rex "FileNotFoundException: (?<file>.*)\." | eval asset_fail_uid=substr(file,len(file)-35) | table asset_fail_uid
I would like to exclude all records from second search from first search. Any help is appreciated. Thanks.
Like this:
index=foo sourcetype="blah" (host="xxx*" OR host="xxx*") (FileNotFoundException OR DownloadException) NOT ("pdf.*" OR "jpg.*")
| eval ExceptionType=if(searchmatch("FileNotFoundException"), "FileNotFoundException", "DownloadException")
| rex "Error in reading an asset: (?<uid>.*)\."
| rex "FileNotFoundException: (?<file>.*)\."
| eval asset_uid=coalesce(substr(uid,len(uid)-35), substr(file,len(file)-35))
| eventstats dc(ExceptionType) AS numExceptionTypes values(ExceptionType) AS ExceptionTypes
| search numExceptionTypes=1 AND ExceptionType="DownloadException"
Like this:
index=foo sourcetype="blah" (host="xxx*" OR host="xxx*") (FileNotFoundException OR DownloadException) NOT ("pdf.*" OR "jpg.*")
| eval ExceptionType=if(searchmatch("FileNotFoundException"), "FileNotFoundException", "DownloadException")
| rex "Error in reading an asset: (?<uid>.*)\."
| rex "FileNotFoundException: (?<file>.*)\."
| eval asset_uid=coalesce(substr(uid,len(uid)-35), substr(file,len(file)-35))
| eventstats dc(ExceptionType) AS numExceptionTypes values(ExceptionType) AS ExceptionTypes
| search numExceptionTypes=1 AND ExceptionType="DownloadException"
Wow, thanks. I just ran the query and it returns no results, which is good.
Thanks for the help!