How to write a search which exclude events found in another source based on some string?

[vickydada]

Hi,

I am facing difficulties in forming one search. Details are following.

Two different searches,

Search1:

source="/opt/pmx6/var/log/message_log" | stats count by t

Search2:

source="/var/log/maillog" "Host or domain name not found" OR "Host not found"| | stats count by to

Here t and to are same fields with same values.

I need a consolidated search in Search1 which gives me results of count t, but exclude the events found in Search2.

So far I've tried,

1)

source="/opt/pmx6/var/log/message_log" | join t [search source="/var/log/maillog" "Host or domain name not found" OR "Host not found" | rename to as t] | stats count t

This search gives me all the events which found respectively in Search2. (Opposite of what I want!)

2)
Tried to add Splunk Suppression,

index=notable| join t [search source="/var/log/maillog" "Host or domain name not found" OR "Host not found"| rename to as t]

But seems like pipes are not allowed there.

It would be a gr8 help. Thanks in advance guys. 🙂

[twinspop]

source="/opt/pmx6/var/log/message_log" NOT [search source="/var/log/maillog" "Host or domain name not found" OR "Host not found"| stats count by to | rename to as t | fields t ] | stats count by t

Another option, potentially avoiding limit issues re: the sub search returning too many results. Use a join with some extra logic:

source="/opt/pmx6/var/log/message_log" | stats count as good by t | join type=outer t  [ search source="/var/log/maillog" "Host or domain name not found" OR "Host not found"| stats count as bad by to | rename to as t ] | where isnotnull(good) and isnull(bad)

The where statement will only keep those rows that have results from search1 AND NOT results from search2.

[sundareshr]

See if this gets you what you are looking for.

source="/opt/pmx6/var/log/message_log" OR source="/var/log/maillog" NOT ("Host or domain name not found" OR "Host not found") | eval tto=coalesce(t, to) | stats count by tto