Splunk Search

How to find a log entry that doesn't have a match with another one?

mortya
New Member

So, I get a bunch of log entries that look something like this (grossly simplified) example:

host1 tag - foo
host1 tag + foo
host1 tag - bar
host1 tag - something
host1 tag + something
host1 tag - evil
host1 tag + blarg
host2 tag - zoinks

I want to find the log entries that have a "- $thing" without a corresponding "+ $thing" in a 24-hour period. So for the above, I want to see "bar evil zoinks".

I can easily write a search to find the "-" entries. But when I try to exclude the ones with a corresponding "+" entry, it gets hairy. The original query already takes a while to run, and I can have thousands of matches. The obvious approach would seem to be a subsearch. But a subsearch seems like it's asking for an N-squared performance. Is there some better way to do this? I would intuitively expect that maybe a join or a selfjoin would help, but I can't figure it out. I'll keep working on this in the meantime.

Thanks!

0 Karma

mayurr98
Super Champion

I don't know if this will work or not but you can give it a try.

<fields with dash and name seperated>| table dash name 
| streamstats values(dash) as d by name |stats values(d) as d by name | where NOT d="+"

Also try this :

<field with dash and name seperated> | table dash name |  transaction name startswith=dash="+" endswith=dash="-" maxevents=2 keepevicted=t | where linecount=1 AND dash="-" AND field_match_sum=1 | table name
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...