Splunk Search

How to filter on multiple events?

harryvdtol
Explorer

Hello,

I have a search that outputs table data that looks like this:

 

 

 

hst	code	type
hosta	01	master
hosta	02	master
hostb	01	host
hostb	03	host
hostc	02	host
hostd	04	host
hoste	05	master
hoste	06	master
hostf	06	host
hostg	08	host

 

 

etc.etc...

I am trying to filter events but i am unable to do.

My goal is to filter events based on this condition:
If the code on a master also exist on the host, then the host rows should be removed

So, my desired output should look like this:

 

 

hst	code	type
hosta	01	master
hosta	02	master
hostb	03	host
hostd	04	host
hoste	05	master
hoste	06	master
hostg	08	host

 

 

I hope someone can help me.
Thanks in advance.

Regards,

Harry

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @harryvdtol,

please try something like this:

<your_search>
| stats first(host) AS host BY code type
| table host code type

Ciao.

Giuseppe

 

View solution in original post

0 Karma

harryvdtol
Explorer

Yes thank you for your help. This is what i made of it.

..
| stats first(hst) as host by code type
| eventstats c as total by code
| where (type="master")  OR (total=1 and type="host")
| table host code type

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @harryvdtol,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @harryvdtol,

please try something like this:

<your_search>
| stats first(host) AS host BY code type
| table host code type

Ciao.

Giuseppe

 

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...