Splunk Search

How to write a search to return values from source1 that do not appear in source2 and source3?

dfigurello
Communicator

Hi Splunkers,

I have three sources in my Splunk deployment:
(all_cardnumbers.csv, fraud_detect1_card.csv and fraud_detect1_card.csv)

all_cardnumbers_card
1111#####1010
1111#####1011
1111#####1012
1111#####1013
1111#####1014
1111#####1015

fraud_detect1_card
1111#####1012
1111#####1013

and the last one fraud_detect2_card source:
1111#####1014
1111#####1015

I'd like to create a new field called no_fraud with the results:
1111#####1010
1111#####1011

Can you guys help me to do a search for this?

Cheers.

Tags (2)
0 Karma

jplumsdaine22
Influencer

I'm assuming your events have only a single field, cardID, (apart from the default fields like source and host).

You should be able to get around using a subsearch with the following. Depending on the size of your fraud_detect csvs, Iguinns subsearch method could be faster - I would try both.

source=*card | stats values(source) as source by cardID | search NOT (source=fraud_detect1_card  OR source=fraud_detect2_card) | rename cardID as no_fraud | table no_fraud 

lguinn2
Legend

Try this

source=all_cardnumbers_card NOT [ search source=fraud_detect*_card | dedup cardID | fields cardID ]

This uses the subsearch feature of Splunk. Note that there are limits to subsearches, so you may want to read the manual page here.

Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Hi Splunky people! We are excited to share the newest updates in Splunk Enterprise 9.3!Admins and Analyst can ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...