Splunk Search

How to filter out main search results with subsearch?

upranger101
Engager

Hi I am trying to capture all event="DcSyncs" from my index. This index also contains event="DcID". The event "DCSyncs" can occur at anytime (pretty often though), but "DcID" occurs once every 8 hours. I am trying to get all "DcSyncs" and then take the HostName field of those results and see if that HostName field has a result for event="DcID". If it does filter it out of the results. To summarize: I am trying to collect all HostName's that have a "DCSyncs" event, but no "DcID" event. I have this setup to run on an 8 hour interval so I don't think I need the time logic of the search.

 I keep trying different variations, but I think I am way off. Any help is appreciated.

index=MyIndex event="DcSyncs"
| join HostName [search NOT index=MyIndex event="DcID"]
| table _time HostName event

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Your query is close, but there's no need for a join, just use the subsearch.

index=MyIndex event="DcSyncs" NOT [search index=MyIndex event="DcID" | fields host]
| table _time HostName event
---
If this reply helps you, Karma would be appreciated.

View solution in original post

upranger101
Engager

Thank you richgalloway. I new host had to be referenced in the subsearch somehow and I didn't know that function exist.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Your query is close, but there's no need for a join, just use the subsearch.

index=MyIndex event="DcSyncs" NOT [search index=MyIndex event="DcID" | fields host]
| table _time HostName event
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...