Splunk Search

How to return which input values did not return results in a splunk query

onelasttime
Engager

I have a list of identifers I need to query splunk for results for, and then display the identifiers that Splunk didn't find any results for. Can someone point me in the right direction on how to accomplish this in a single search?

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @onelasttime,

as @richgalloway said, Splunk lists only the results it found so to have also the not found values you have to add them.

The way to do this depends on the kind of objects to search; e.g. if you have to identify the hosts that disn't received logs, you could create a lookup (called e.g. perimeter.csv) containing the field to search (e.g. host) and then run a search like this:

index=your_index
| eval host=lower(host)
| stats count BY host
| append [ | inputlookup perimeter.csv | eval host=lower(host), count=0 | fields host count ]
| stats sum(count) AS total By host
| where total=0

So, when you speak of "a list of identifiers" are you speaking of strings to find in the full events (_row) or values of a field?

If values of a field, you could use the same approach od my sample, if instead you're meaning of strings to search in the full events (_row)  is just a little more complicated.

Ciao.

Giuseppe

0 Karma

richgalloway
SplunkTrust
SplunkTrust

See this blog entry for a good write-up on how to do that.

https://www.duanewaddle.com/proving-a-negative/

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...