Splunk Search

How to find records where a field's value doesn't exist in a subsearch?

saqib99
New Member

I have the following two searches:

1) earliest=-4h latest=now index="main" field1="somethingA"
2) earliest=-4h latest=now index="main" field2="somethingB"

All records contain a field name field3.

I want to find all the records that are in query #1 but whose field3 is not found in any records in query #2.

How can I do it?

0 Karma

saqib99
New Member

This worked:

> earliest=-4h latest=now index="main" field1="somethingA" NOT [search earliest=-4h latest=now index="main" field2="somethingB" | fields + field3]
0 Karma

to4kawa
Ultra Champion

I see, please accept your answer and close.

0 Karma

to4kawa
Ultra Champion
index=main (field1="somethingA" OR field2="somethingB" ) earliest=-4h latest=now 
| streamstats window=1 values(eval(if(field1="somethingA" AND NOT field2="somethingB","flag",NULL))) as field3_exc_field2_inc_field1
| where field3_exc_field2_inc_field1="flag"

hi, @saqib99
how about this?

0 Karma

saqib99
New Member

That didn't work. But the answer shown below did.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...