Splunk Search

Problem with getting all non matching events with outer join

C_Sparn
Communicator

Hello,

is there an easy possibility to get all events that have non matching field values after an outer join? Here is an example what I tried allready:

sourcetype=typ1 | eval Number = Number1 | join type=outer Number [search sourcetype= type2 | eval Number = Number2]

This gives me all events where field Number1 and field Number2 are equal and not equal.
How can I get just these events now, where they are not equal?
Thanks for help.

C_Sparn

0 Karma
1 Solution

C_Sparn
Communicator

I found a solution now!
It looks like this:

sourcetype=typ1 | eval Number = Number1 | join type=outer Number [search sourcetype= type2 | eval Number = Number2] |search NOT Number2 = *

OR another way is this:

sourcetype=typ1 | eval Number = Number1 | join type=outer Number [search sourcetype= type2 | eval Number = Number2] |search NOT sourcetype = type2

Greetings
C_Sparn

View solution in original post

C_Sparn
Communicator

I found a solution now!
It looks like this:

sourcetype=typ1 | eval Number = Number1 | join type=outer Number [search sourcetype= type2 | eval Number = Number2] |search NOT Number2 = *

OR another way is this:

sourcetype=typ1 | eval Number = Number1 | join type=outer Number [search sourcetype= type2 | eval Number = Number2] |search NOT sourcetype = type2

Greetings
C_Sparn

richgalloway
SplunkTrust
SplunkTrust

Maybe something like this?

sourcetype=typ1 | eval Number = Number1 | eval NumberA = Number | join type=outer Number [search sourcetype= type2 | eval Number = Number2 | eval NumberB = Number] | where NumberA != NumberB
---
If this reply helps you, Karma would be appreciated.
0 Karma

C_Sparn
Communicator

This gives 0 results back. But thanks for the suggestion.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...