Hi @Andresfrj,
you have to use a subsearch.
Only limit is that a subsearch can have max 50,000 results,
so you can use something lieke this.
The rule is to identify key fields.
So if the key field is field1, you can run something like this:
index=indexA NOT [ search index=indexB | fields field1 ]
| ...
if instead subsearch can have more than 50,000 results, the solution is just a little more complex:
index=indexA OR index=indexB
| stats earliest(_time) AS _time dc(index) AS index_count values(index) AS index BY field1
| where index_count=1 AND index=indexA
you can add to the stats command all the "values(field) AS field" you need.
Ciao.
Giuseppe
Hi @Andresfrj,
you have to use a subsearch.
Only limit is that a subsearch can have max 50,000 results,
so you can use something lieke this.
The rule is to identify key fields.
So if the key field is field1, you can run something like this:
index=indexA NOT [ search index=indexB | fields field1 ]
| ...
if instead subsearch can have more than 50,000 results, the solution is just a little more complex:
index=indexA OR index=indexB
| stats earliest(_time) AS _time dc(index) AS index_count values(index) AS index BY field1
| where index_count=1 AND index=indexA
you can add to the stats command all the "values(field) AS field" you need.
Ciao.
Giuseppe
Hi @Andresfrj,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated by all the contributors 😉
Hi
here is excellent description how to avoid to use command join when you are doing “sql joins” https://community.splunk.com/t5/Splunk-Search/What-is-the-relation-between-the-Splunk-inner-left-joi...
r. Ismo