Splunk Search

Is it possible to use saved searches to exclude results in another search?

Engager

Is it possible to use saved searches to exclude results in another search?

Something like :

Error NOT IN savedsearch("knownIssue1", "knownIssue2")

Thanks

SplunkTrust
SplunkTrust

Its is possible (not in the format you mentioned) using subsearch as filter. May be something like this (assumming both the saved searches have field called Error which you need to filter from base search)

your base search e.g. index=xxx sourcetype=yyy NOT [|savedsearch knownIssue1 | table Error | append [|savedsearch knownIssue2 | table Error]] |...rest of the search

Samples of subsearch being used as filter
http://answers.splunk.com/answers/89845/filter-search-results-based-on-return-value-of-subsearch

Engager

Cool. That should work for me.

Thanks for the answer and link.

0 Karma

SplunkTrust
SplunkTrust

Good catch. Totally missed that one.

SplunkTrust
SplunkTrust

Don't forget the NOT before the first opening square bracket to exclude the key-value-pairs from the subsearch rather than to require them.