Splunk Search

How to return which input values did not return results in a splunk query

onelasttime
Engager

I have a list of identifers I need to query splunk for results for, and then display the identifiers that Splunk didn't find any results for. Can someone point me in the right direction on how to accomplish this in a single search?

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @onelasttime,

as @richgalloway said, Splunk lists only the results it found so to have also the not found values you have to add them.

The way to do this depends on the kind of objects to search; e.g. if you have to identify the hosts that disn't received logs, you could create a lookup (called e.g. perimeter.csv) containing the field to search (e.g. host) and then run a search like this:

index=your_index
| eval host=lower(host)
| stats count BY host
| append [ | inputlookup perimeter.csv | eval host=lower(host), count=0 | fields host count ]
| stats sum(count) AS total By host
| where total=0

So, when you speak of "a list of identifiers" are you speaking of strings to find in the full events (_row) or values of a field?

If values of a field, you could use the same approach od my sample, if instead you're meaning of strings to search in the full events (_row)  is just a little more complicated.

Ciao.

Giuseppe

0 Karma

richgalloway
SplunkTrust
SplunkTrust

See this blog entry for a good write-up on how to do that.

https://www.duanewaddle.com/proving-a-negative/

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...