Performing Set operation using splunk query

[darkhorse91]

Hi ,

I have two queries, that have a common field someField

one helps me find inconsistencies:

sourcetype="my_source" someLog inconsistencies 

 other helps me find consistencies

sourcetype="my_source" someLog consistencies 

 This gives me both consistencies and inconsistencies:

sourcetype="my_source" someLog 

 Note that

someLog

 is just a text used an identifier that's common for both the queries.

if the someField was logged as inconsistent it can be logged as consistent in the future.

How can I find those values of someField that are truly inconsistent in a given time frame, retrospectively?i.e. if currently values are inconsistent I want to be able to search (in the past or future relative to the current search) those values that are truly inconsistent - not part of the consistent results in that time frame

[yuanliu]

As you noted that "someLog" is just a text identifier to connect the two sets.  I deduce that "consistencies" and "inconsistencies" are also mere text identifiers, not associated with a specific field.

If this is correct, your problem can be clarified as: Find values of someField that only occurs in events that contains identifier term "inconsistencies" and that do not contain identifier term "consistencies".  This way, it is easy to translate into SPL:

sourcetype="my_source" someLog (consistencies OR inconsistencies)
| eval consistent_or_not = if(searchmatch("consistencies"), "consistent", "inconsistent")
| stats values(someField) as someField by consistent_or_not
| stats values(consistent_or_not) as consistent_or_not by someField
| where mvcount(consistent_or_not) < 2 AND consistent_or_not == "inconsistent"

Hope this helps.