Make sure Value from one specific event is not in any other events

[splunk219783]

I can't wrap my head around how to do this search.  It's like I need an array or variable.

Example Data:

Hostname	Storage
BackupServer	BackupStorage
Database1	Storage1
Database2	Storage2
Database3	BackupStorage

How can I say, show me a list of all servers using BackupServer[Storage], I dont know the name of backup storage in advance. All I know is the hostname is like Backupserver.

[ITWhisperer · Accepted solution]

Do you mean something like this?

| eventstats values(Hostname) as hosts by Storage
| where isnotnull(mvfind(hosts,"BackupServer"))

[splunk219783]

When I try that I just get my BackupServer.  I shouldn't clarified, i'd like a search that only Shows me Database3 in the example dataset, but without knowing the Storage is "BackupStorage" to begin with.  I need to lookup the datastore of backupserver, then make sure none of the others are on there.

[PickleRick]

<your search>
| stats values(Hostname) as Hostname by Storage
| where Hostname="BackupServer"

[ITWhisperer]

I am not sure I understand your requirement - do you know the name of the BackupServer or not?

| eventstats values(Hostname) as hosts by Storage
| where isnotnull(mvfind(hosts,"BackupServer")) AND Hostname!="BackupServer"

If not, how do you identify which host is being used for backup storage?

[splunk219783]

I apologize if I'm being confusing. Let me try to explain it better.   This backup server backups databases.  I need to make sure none of the databases are on the same storage as the backup server.  Because if we lost that storage we would lose both our backups and the database.

Here's the steps i'm trying to do with SPL.

1. Lookup what storage BackupServer is using with a search.  Something like a 

index=servers server=backups | fields Storage

2. Make sure No Databases are using that Storage.  I do not know which storage the backup server will be on, it could move around.

index=servers server=*Database* storage!=[Storagestringfromabove]

This is the search i've thrown together so far.  The only way I can think of to accomplish 1 & 2, is to output my backup storage to a lookup table, then look for a match.

index=servers source=*vmdk* VM=*database*| fields Datastore VM
| search [inputlookup backup_server.csv | fields Datastore]
| table VM Datastore 

[yuanliu]

Based on your illustrations 1 and 2, I think ITWhisperer's method should work, like this:

index=servers (server=backups OR server=*Database*)
| eventstats values(server) as servergroup by Storage
| where isnull(mvfind(servergroup, backups))

Basically, eventstats groups servers based on Storage they use; mvfind() selects those servers that uses the same Storage as used by "backups".  Then, isnull() negates the find to pick out those that do not use that storage.

[ITWhisperer]

This line creates a list of all the host which share the same storage by storage name

| eventstats values(Hostname) as hosts by Storage

This line picks out the hosts which share the same storage as BackupServer

| where isnotnull(mvfind(hosts,"BackupServer")) AND Hostname!="BackupServer"

 How is that not what you have asked for?

[splunk219783]

Apologies for the delayed response, I was out of the office for a few days.  Your example does work, thank you! I must've had a typo or something initially.