Splunk Search

How to use NOT-EXISTS in SPLUNK ?

Real_captain
Explorer

Hi 

I want to create a search to find all the events for which last row exists but there is atleast 1 row missing. Example is attached below : 

Splunk Query : 

`macro_events_prod_gch_comms_esa` 
gch_messageType="Seev.047*" host="p*" gch_status="*" NOT"BCS" | table BO_PageNumber,BO_LastPage,gch_status
|rename BO_PageNumber as PageNo , BO_LastPage as LastPage , gch_status as Status
| sort by PageNo

Requirement is find all the events for which LastPage as True exists and there is atleast 1 row missing with PageNo  less than the PageNo of row with  LastPage as True.  

 

 

 

Real_captain_0-1707469094624.png

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| streamstats count
| where PageNo != count
0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...