How to remove elements from first search with a second search?

[Andresfrj]

Hello,

I want to perform the above operation. I have a first search (A), and want to remove elements in it (in this case a field called id) from a second search B. What is the most clean way of implementing this such search? 

[gcusello · Accepted solution]

Hi @Andresfrj,

you have to use a subsearch.

Only limit is that a subsearch can have max 50,000 results,

so you can use something lieke this.

The rule is to identify key fields.

So if the key field is field1, you can run something like this:

index=indexA NOT [ search index=indexB | fields field1 ]
| ...

if instead subsearch can have more than 50,000 results, the solution is just a little more complex:

index=indexA OR index=indexB
| stats earliest(_time) AS _time dc(index) AS index_count values(index) AS index BY field1
| where  index_count=1 AND index=indexA

you can add to the stats command all the "values(field) AS field" you need.

Ciao.

Giuseppe

[gcusello]

Hi @Andresfrj,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[isoutamo]

Hi

here is excellent description how to avoid to use command join when you are doing “sql joins” https://community.splunk.com/t5/Splunk-Search/What-is-the-relation-between-the-Splunk-inner-left-joi...

r. Ismo