Splunk Search

How to join two queries and show not contain value

JandrevdM
Path Finder

Good day, I am pretty new to Splunk and want a way to join two queries together.

Query 1 - Gives me all of my assets

| tstats count where index=_internal OR index=* BY host



Query 2 - Give me all of my devices that ingest into the forwarder

index="_internal" source="*metrics.log*" group=tcpin_connections
| dedup hostname
| table date_hour, date_minute, date_mday, date_month, date_year, hostname, sourceIp, fwdType ,guid ,version ,build ,os ,arch
| stats count




How can I join this to create a query that will find all my devices (query1) and check if they have the forwarder installed(query2) and show me the results of devices that are not in query 2?

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Have you tried it this way:

| tstats count where index=_internal OR index=* [ search index=db_cloud sourcetype="azure:compute:vm:instanceView"
| stats count by host
| table host ] NOT [search index="_internal" source="*metrics.log*" group=tcpin_connections
| stats count by hostname | rename hostname as host | table host] BY host

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

You could try something like this

| tstats count where index=_internal OR index=* NOT [search index="_internal" source="*metrics.log*" group=tcpin_connections
| stats count by hostname | rename hostname as host | table host] BY host

JandrevdM
Path Finder

Thanks!

I tried different ways but am unable to get this, if I want to add a line to check if the device is an azure VM how would I do this?

| tstats count where index=_internal OR index=* NOT [search index="_internal" source="*metrics.log*" group=tcpin_connections
| stats count by hostname | rename hostname as host | table host] BY host

AND

[ search index=db_cloud sourcetype="azure:compute:vm:instanceView"
| rename host as host_changed
| table host_changed] BY host



I tried this but it does not work 😞

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Have you tried it this way:

| tstats count where index=_internal OR index=* [ search index=db_cloud sourcetype="azure:compute:vm:instanceView"
| stats count by host
| table host ] NOT [search index="_internal" source="*metrics.log*" group=tcpin_connections
| stats count by hostname | rename hostname as host | table host] BY host

JandrevdM
Path Finder

The count is just used in my dashboard view and will be removed in initial query.

 

0 Karma
Get Updates on the Splunk Community!

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...