Splunk Search

Result that does not match an item in list

vschrodda
Explorer

 

With a search I would like a result that does NOT match an element in a list

For instance:

 

 

 

index=myindex source="mysource_*" earliest-30m

 

 

 

I'd like to compare the sources against a list, such as:

 

 

 

("*one","*two","*three")

 

 

 

If the search results, for instance, DON'T include events with the source "mysource_three" I would like a result that states this.  Ultimately, I'm looking to create an alert based on the query; if there are no events seen from some sources in the last 30 minutes.

Labels (2)
0 Karma
1 Solution

vschrodda
Explorer

Figured out what I needed

index=myindex source="mysource_*" earliest=-30m | stats count by source | table source | eval Found=1 | append [|inputlookup mylookup_table.csv | table source | eval Found=0] | stats max(Found) as Found by source | where Found=0

View solution in original post

vschrodda
Explorer

Figured out what I needed

index=myindex source="mysource_*" earliest=-30m | stats count by source | table source | eval Found=1 | append [|inputlookup mylookup_table.csv | table source | eval Found=0] | stats max(Found) as Found by source | where Found=0

richgalloway
SplunkTrust
SplunkTrust

Perhaps this will get you started.

index=myindex source="mysource_*" earliest-30m
| regex source!="mysource_(?:one|two|three)"

If you get any results, then trigger an alert.

---
If this reply helps you, Karma would be appreciated.
0 Karma

vschrodda
Explorer

This results in a 'source' that did not match an element in the list.  I can do this without issue.  I'm trying to determine which element(s) did not have any matching events (there would be no matching events in the last 30 minutes)

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I got lost with all the negatives in that.  What problem are you trying to solve?

---
If this reply helps you, Karma would be appreciated.
0 Karma

vschrodda
Explorer

I'm simply trying to determine/list any elements ("*one","*two","*three")  did not have any matching events in given time frame

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...