Splunk Search

Looking for exclusion query


I am having index (server_patching) which contain the details like changeNo, patching date etc of server which are patched on given date and Lookup table with lists all the servers which are present in my environment.

lets say I have 10 servers in lookup table (1,2,3,4,5,6.......10) out of which

server 12,3 are patched on Nov 1st with patch number p1,p2,p3

server 4,5,6,7,8 are patched on Dec 1st  with patch number p4,p5,p6,p7,p8

Server 9,10 are patched in Jan 1st with patch number p9,p10

I want to write query which should give me the server name and patch number which are not patched in given time.

example if I select Jan1

I should get result

Server 1,2,3,4,5,6,7,8

Patch number p1,p2,p3,p4,p5,p6,p7,p8


thanks In advance

Labels (1)
0 Karma


Hi @ChetanArgekar ,

to do what you're sayng, you have to run a search on all the time (or something similar) because you have to take all the values, not only the ones of January.

So you could create a dashboard with all the data in three or four months (see what's a period in which you're sure to have a patch for each server) and then create an input to select the update month.

If your search is slow, you could think to schedule it in a nightly report or in a summary index and display results.



0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...