Splunk Search

How to find values that are not in a summary index

mpasha
Path Finder

Good day,
I have sysmon information collected in an index called sysmon. I also have created a summary index "HASh256" of all hashes that are known to be good.

I'd like to write a search that shows me all the events that the hash is not found in the summary index. I was planning to use the join command but seems to join only works when you want to include results from the main search and the subsearch.
I want to exclude entries that are found in the subsearch.
How can I achieve that?

Appreciate any help.

0 Karma

jacobpevans
Motivator

You can just use | search NOT followed by a subsearch, e.g.

           | makeresults | eval Field=1
| append [ | makeresults |  eval Field=2 ]
| append [ | makeresults | eval Field=3 ]
| search NOT [ | makeresults | eval Field=2 ]

Or, in your case:

index=sysmon Field1=*
| search NOT [ | search index=HASH256 | dedup Field1 | fields Field1 ]
Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...