Splunk Search

How to filter a search result based on the results of another search?

AllenZhang
Explorer

I have 2 searches:

search AAA|table User
Search BBB|tabble User

How can I filter the result of Search AAA so it only shows those Users which are NOT found in search BBB?

Thanks

Allen

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi AllenZhang,

although I'm no fan of sub searches, you can do it with a subsearch:

search AAA | search NOT [ search BBB | table User ]

Here are some reasons why it is not always a good idea to use subsearch http://docs.splunk.com/Documentation/Splunk/6.3.1/Search/Aboutsubsearches#Subsearch_performance

Hope this helps ...

cheers, MuS

Update:
Here is run everywhere example which is doing the same without a subsearch:

 index=_internal OR index=_audit 
 | stats dc(user) AS dc by user,index 
 | stats sum(dc) AS sum values(index) AS index by user 
 | table index user sum 
 | where sum="1"

It search in two indexes for users which are only found in one of the indexes.

cheers, MuS

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...