Splunk Search

Looking for exclusion query

ChetanArgekar
Explorer

I am having index (server_patching) which contain the details like changeNo, patching date etc of server which are patched on given date and Lookup table with lists all the servers which are present in my environment.

lets say I have 10 servers in lookup table (1,2,3,4,5,6.......10) out of which

server 12,3 are patched on Nov 1st with patch number p1,p2,p3

server 4,5,6,7,8 are patched on Dec 1st  with patch number p4,p5,p6,p7,p8

Server 9,10 are patched in Jan 1st with patch number p9,p10

I want to write query which should give me the server name and patch number which are not patched in given time.

example if I select Jan1

I should get result

Server 1,2,3,4,5,6,7,8

Patch number p1,p2,p3,p4,p5,p6,p7,p8

 

thanks In advance

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ChetanArgekar ,

to do what you're sayng, you have to run a search on all the time (or something similar) because you have to take all the values, not only the ones of January.

So you could create a dashboard with all the data in three or four months (see what's a period in which you're sure to have a patch for each server) and then create an input to select the update month.

If your search is slow, you could think to schedule it in a nightly report or in a summary index and display results.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...