Splunk Search

Problem with getting all non matching events with outer join

C_Sparn
Communicator

Hello,

is there an easy possibility to get all events that have non matching field values after an outer join? Here is an example what I tried allready:

sourcetype=typ1 | eval Number = Number1 | join type=outer Number [search sourcetype= type2 | eval Number = Number2]

This gives me all events where field Number1 and field Number2 are equal and not equal.
How can I get just these events now, where they are not equal?
Thanks for help.

C_Sparn

0 Karma
1 Solution

C_Sparn
Communicator

I found a solution now!
It looks like this:

sourcetype=typ1 | eval Number = Number1 | join type=outer Number [search sourcetype= type2 | eval Number = Number2] |search NOT Number2 = *

OR another way is this:

sourcetype=typ1 | eval Number = Number1 | join type=outer Number [search sourcetype= type2 | eval Number = Number2] |search NOT sourcetype = type2

Greetings
C_Sparn

View solution in original post

C_Sparn
Communicator

I found a solution now!
It looks like this:

sourcetype=typ1 | eval Number = Number1 | join type=outer Number [search sourcetype= type2 | eval Number = Number2] |search NOT Number2 = *

OR another way is this:

sourcetype=typ1 | eval Number = Number1 | join type=outer Number [search sourcetype= type2 | eval Number = Number2] |search NOT sourcetype = type2

Greetings
C_Sparn

richgalloway
SplunkTrust
SplunkTrust

Maybe something like this?

sourcetype=typ1 | eval Number = Number1 | eval NumberA = Number | join type=outer Number [search sourcetype= type2 | eval Number = Number2 | eval NumberB = Number] | where NumberA != NumberB
---
If this reply helps you, Karma would be appreciated.
0 Karma

C_Sparn
Communicator

This gives 0 results back. But thanks for the suggestion.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...