Splunk Search

Problem with getting all non matching events with outer join

C_Sparn
Communicator

Hello,

is there an easy possibility to get all events that have non matching field values after an outer join? Here is an example what I tried allready:

sourcetype=typ1 | eval Number = Number1 | join type=outer Number [search sourcetype= type2 | eval Number = Number2]

This gives me all events where field Number1 and field Number2 are equal and not equal.
How can I get just these events now, where they are not equal?
Thanks for help.

C_Sparn

0 Karma
1 Solution

C_Sparn
Communicator

I found a solution now!
It looks like this:

sourcetype=typ1 | eval Number = Number1 | join type=outer Number [search sourcetype= type2 | eval Number = Number2] |search NOT Number2 = *

OR another way is this:

sourcetype=typ1 | eval Number = Number1 | join type=outer Number [search sourcetype= type2 | eval Number = Number2] |search NOT sourcetype = type2

Greetings
C_Sparn

View solution in original post

C_Sparn
Communicator

I found a solution now!
It looks like this:

sourcetype=typ1 | eval Number = Number1 | join type=outer Number [search sourcetype= type2 | eval Number = Number2] |search NOT Number2 = *

OR another way is this:

sourcetype=typ1 | eval Number = Number1 | join type=outer Number [search sourcetype= type2 | eval Number = Number2] |search NOT sourcetype = type2

Greetings
C_Sparn

richgalloway
SplunkTrust
SplunkTrust

Maybe something like this?

sourcetype=typ1 | eval Number = Number1 | eval NumberA = Number | join type=outer Number [search sourcetype= type2 | eval Number = Number2 | eval NumberB = Number] | where NumberA != NumberB
---
If this reply helps you, Karma would be appreciated.
0 Karma

C_Sparn
Communicator

This gives 0 results back. But thanks for the suggestion.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...