How to filter on multiple events?

[harryvdtol]

Hello,

I have a search that outputs table data that looks like this:

hst	code	type
hosta	01	master
hosta	02	master
hostb	01	host
hostb	03	host
hostc	02	host
hostd	04	host
hoste	05	master
hoste	06	master
hostf	06	host
hostg	08	host

etc.etc...

I am trying to filter events but i am unable to do.

My goal is to filter events based on this condition:
If the code on a master also exist on the host, then the host rows should be removed

So, my desired output should look like this:

hst	code	type
hosta	01	master
hosta	02	master
hostb	03	host
hostd	04	host
hoste	05	master
hoste	06	master
hostg	08	host

I hope someone can help me.
Thanks in advance.

Regards,

Harry

[harryvdtol]

Yes thank you for your help. This is what i made of it.

..
| stats first(hst) as host by code type
| eventstats c as total by code
| where (type="master")  OR (total=1 and type="host")
| table host code type

[gcusello]

Hi @harryvdtol,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[gcusello · Accepted solution]

Hi @harryvdtol,

please try something like this:

<your_search>
| stats first(host) AS host BY code type
| table host code type

Ciao.

Giuseppe